parse.c

Bug Summary

File:	src/sbin/pfctl/obj/parse.c
Warning:	line 8428, column 9 Although the value stored to 'qsi' is used in the enclosing expression, the value is never actually read from 'qsi'

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name parse.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sbin/pfctl/obj -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sbin/pfctl -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -Wno-uninitialized -fdebug-compilation-dir=/usr/src/sbin/pfctl/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c parse.c

1	#include <stdlib.h>
2	#include <string.h>
3	#define YYBYACC1 1
4	#define YYMAJOR1 1
5	#define YYMINOR9 9
6	#define YYLEXyylex() yylex()
7	#define YYEMPTY-1 -1
8	#define yyclearin(yychar=(-1)) (yychar=(YYEMPTY-1))
9	#define yyerrok(yyerrflag=0) (yyerrflag=0)
10	#define YYRECOVERING()(yyerrflag!=0) (yyerrflag!=0)
11	#define YYPREFIX"yy" "yy"
12	#line 30 "/usr/src/sbin/pfctl/parse.y"
13	#include <sys/types.h>
14	#include <sys/socket.h>
15	#include <sys/stat.h>
16	#include <sys/sysctl.h>
17	#include <net/if.h>
18	#include <netinet/in.h>
19	#include <netinet/ip.h>
20	#include <netinet/ip_icmp.h>
21	#include <netinet/icmp6.h>
22	#include <net/pfvar.h>
23	#include <arpa/inet.h>
24
25	#include <stdio.h>
26	#include <unistd.h>
27	#include <stdlib.h>
28	#include <netdb.h>
29	#include <stdarg.h>
30	#include <errno(*__errno()).h>
31	#include <string.h>
32	#include <ctype.h>
33	#include <math.h>
34	#include <err.h>
35	#include <limits.h>
36	#include <pwd.h>
37	#include <grp.h>
38	#include <md5.h>
39
40	#include "pfctl_parser.h"
41	#include "pfctl.h"
42
43	static struct pfctl pf = NULL((void )0);
44	static int debug = 0;
45	static u_int16_t returnicmpdefault =
46	(ICMP_UNREACH3 << 8) \| ICMP_UNREACH_PORT3;
47	static u_int16_t returnicmp6default =
48	(ICMP6_DST_UNREACH1 << 8) \| ICMP6_DST_UNREACH_NOPORT4;
49	static int blockpolicy = PFRULE_DROP0x0000;
50	static int default_statelock;
51
52	TAILQ_HEAD(files, file)struct files { struct file tqh_first; struct file tqh_last ; } files = TAILQ_HEAD_INITIALIZER(files){ ((void )0), &(files).tqh_first };
53	static struct file {
54	TAILQ_ENTRY(file)struct { struct file tqe_next; struct file *tqe_prev; } entry;
55	FILE *stream;
56	char *name;
57	size_t ungetpos;
58	size_t ungetsize;
59	u_char *ungetbuf;
60	int eof_reached;
61	int lineno;
62	int errors;
63	} file, topfile;
64	struct file pushfile(const char , int);
65	int popfile(void);
66	int check_file_secrecy(int, const char *);
67	int yyparse(void);
68	int yylex(void);
69	int yyerror(const char *, ...)
70	__attribute__((__format__ (printf, 1, 2)))
71	__attribute__((__nonnull__ (1)));
72	int kw_cmp(const void , const void );
73	int lookup(char *);
74	int igetc(void);
75	int lgetc(int);
76	void lungetc(int);
77	int findeol(void);
78
79	TAILQ_HEAD(symhead, sym)struct symhead { struct sym tqh_first; struct sym tqh_last ; } symhead = TAILQ_HEAD_INITIALIZER(symhead){ ((void )0), &(symhead).tqh_first };
80	struct sym {
81	TAILQ_ENTRY(sym)struct { struct sym tqe_next; struct sym *tqe_prev; } entry;
82	int used;
83	int persist;
84	char *nam;
85	char *val;
86	};
87	int symset(const char , const char , int);
88	char symget(const char );
89
90	int atoul(char , u_long );
91
92	struct node_proto {
93	u_int8_t proto;
94	struct node_proto *next;
95	struct node_proto *tail;
96	};
97
98	struct node_port {
99	u_int16_t port[2];
100	u_int8_t op;
101	struct node_port *next;
102	struct node_port *tail;
103	};
104
105	struct node_uid {
106	uid_t uid[2];
107	u_int8_t op;
108	struct node_uid *next;
109	struct node_uid *tail;
110	};
111
112	struct node_gid {
113	gid_t gid[2];
114	u_int8_t op;
115	struct node_gid *next;
116	struct node_gid *tail;
117	};
118
119	struct node_icmp {
120	u_int16_t code; /* aux. value 256 is legit */
121	u_int16_t type; /* aux. value 256 is legit */
122	u_int8_t proto;
123	struct node_icmp *next;
124	struct node_icmp *tail;
125	};
126
127	enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK,
128	PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN,
129	PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES,
130	PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK,
131	PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY,
132	PF_STATE_OPT_PFLOW };
133
134	enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE };
135
136	struct node_state_opt {
137	int type;
138	union {
139	u_int32_t max_states;
140	u_int32_t max_src_states;
141	u_int32_t max_src_conn;
142	struct {
143	u_int32_t limit;
144	u_int32_t seconds;
145	} max_src_conn_rate;
146	struct {
147	u_int8_t flush;
148	char tblname[PF_TABLE_NAME_SIZE32];
149	} overload;
150	u_int32_t max_src_nodes;
151	u_int8_t src_track;
152	u_int32_t statelock;
153	struct {
154	int number;
155	u_int32_t seconds;
156	} timeout;
157	} data;
158	struct node_state_opt *next;
159	struct node_state_opt *tail;
160	};
161
162	struct peer {
163	struct node_host *host;
164	struct node_port *port;
165	};
166
167	struct node_queue {
168	char queue[PF_QNAME_SIZE64];
169	char parent[PF_QNAME_SIZE64];
170	char ifname[IFNAMSIZ16];
171	int scheduler;
172	struct node_queue *next;
173	struct node_queue *tail;
174	};
175
176	struct node_qassign {
177	char *qname;
178	char *pqname;
179	};
180
181	struct range {
182	int a;
183	int b;
184	int t;
185	};
186	struct redirection {
187	struct node_host *host;
188	struct range rport;
189	};
190
191	struct pool_opts {
192	int marker;
193	#define POM_TYPE0x01 0x01
194	#define POM_STICKYADDRESS0x02 0x02
195	u_int8_t opts;
196	int type;
197	int staticport;
198	struct pf_poolhashkey *key;
199
200	} pool_opts;
201
202	struct divertspec {
203	struct node_host *addr;
204	u_int16_t port;
205	enum pf_divert_types type;
206	};
207
208	struct redirspec {
209	struct redirection *rdr;
210	struct pool_opts pool_opts;
211	int binat;
212	int af;
213	};
214
215	struct filter_opts {
216	int marker;
217	#define FOM_FLAGS0x0001 0x0001
218	#define FOM_ICMP0x0002 0x0002
219	#define FOM_TOS0x0004 0x0004
220	#define FOM_KEEP0x0008 0x0008
221	#define FOM_SRCTRACK0x0010 0x0010
222	#define FOM_MINTTL0x0020 0x0020
223	#define FOM_MAXMSS0x0040 0x0040
224	#define FOM_AFTO0x0080 0x0080
225	#define FOM_SETTOS0x0100 0x0100
226	#define FOM_SCRUB_TCP0x0200 0x0200
227	#define FOM_SETPRIO0x0400 0x0400
228	#define FOM_ONCE0x1000 0x1000
229	#define FOM_PRIO0x2000 0x2000
230	#define FOM_SETDELAY0x4000 0x4000
231	struct node_uid *uid;
232	struct node_gid *gid;
233	struct node_if *rcv;
234	struct {
235	u_int8_t b1;
236	u_int8_t b2;
237	u_int16_t w;
238	u_int16_t w2;
239	} flags;
240	struct node_icmp *icmpspec;
241	u_int32_t tos;
242	u_int32_t prob;
243	struct {
244	int action;
245	struct node_state_opt *options;
246	} keep;
247	int fragment;
248	int allowopts;
249	char *label;
250	struct node_qassign queues;
251	char *tag;
252	char *match_tag;
253	u_int8_t match_tag_not;
254	u_int rtableid;
255	u_int8_t prio;
256	u_int8_t set_prio[2];
257	u_int16_t delay;
258	struct divertspec divert;
259	struct redirspec nat;
260	struct redirspec rdr;
261	struct redirspec rroute;
262	u_int8_t rt;
263
264	/* scrub opts */
265	int nodf;
266	int minttl;
267	int settos;
268	int randomid;
269	int max_mss;
270
271	struct {
272	u_int32_t limit;
273	u_int32_t seconds;
274	} pktrate;
275	} filter_opts;
276
277	struct antispoof_opts {
278	char *label;
279	u_int rtableid;
280	} antispoof_opts;
281
282	struct scrub_opts {
283	int marker;
284	int nodf;
285	int minttl;
286	int maxmss;
287	int randomid;
288	int reassemble_tcp;
289	} scrub_opts;
290
291	struct node_sc {
292	struct node_queue_bw m1;
293	u_int d;
294	struct node_queue_bw m2;
295	};
296
297	struct node_fq {
298	u_int flows;
299	u_int quantum;
300	u_int target;
301	u_int interval;
302	};
303
304	struct queue_opts {
305	int marker;
306	#define QOM_BWSPEC0x01 0x01
307	#define QOM_PARENT0x02 0x02
308	#define QOM_DEFAULT0x04 0x04
309	#define QOM_QLIMIT0x08 0x08
310	#define QOM_FLOWS0x10 0x10
311	#define QOM_QUANTUM0x20 0x20
312	struct node_sc realtime;
313	struct node_sc linkshare;
314	struct node_sc upperlimit;
315	struct node_fq flowqueue;
316	char *parent;
317	int flags;
318	u_int qlimit;
319	} queue_opts;
320
321	struct table_opts {
322	int flags;
323	int init_addr;
324	struct node_tinithead init_nodes;
325	} table_opts;
326
327	struct node_hfsc_opts hfsc_opts;
328	struct node_state_opt keep_state_defaults = NULL((void )0);
329	struct pfctl_watermarks syncookie_opts;
330
331	int validate_range(u_int8_t, u_int16_t, u_int16_t);
332	int disallow_table(struct node_host , const char );
333	int disallow_urpf_failed(struct node_host , const char );
334	int disallow_alias(struct node_host , const char );
335	int rule_consistent(struct pf_rule *);
336	int process_tabledef(char , struct table_opts , int);
337	void expand_label_str(char , size_t, const char , const char *);
338	void expand_label_if(const char , char , size_t, const char *);
339	void expand_label_addr(const char , char , size_t, u_int8_t,
340	struct node_host *);
341	void expand_label_port(const char , char , size_t,
342	struct node_port *);
343	void expand_label_proto(const char , char , size_t, u_int8_t);
344	void expand_label(char , size_t, const char , u_int8_t,
345	struct node_host , struct node_port , struct node_host *,
346	struct node_port *, u_int8_t);
347	int expand_divertspec(struct pf_rule , struct divertspec );
348	int collapse_redirspec(struct pf_pool , struct pf_rule ,
349	struct redirspec *rs, int);
350	int apply_redirspec(struct pf_pool , struct pf_rule ,
351	struct redirspec , int, struct node_port );
352	void expand_rule(struct pf_rule , int, struct node_if ,
353	struct redirspec , struct redirspec , struct redirspec *,
354	struct node_proto *,
355	struct node_os , struct node_host , struct node_port *,
356	struct node_host , struct node_port , struct node_uid *,
357	struct node_gid , struct node_if , struct node_icmp *);
358	int expand_queue(char , struct node_if , struct queue_opts *);
359	int expand_skip_interface(struct node_if *);
360
361	int getservice(char *);
362	int rule_label(struct pf_rule , char );
363
364	void mv_rules(struct pf_ruleset , struct pf_ruleset );
365	void decide_address_family(struct node_host , sa_family_t );
366	int invalid_redirect(struct node_host *, sa_family_t);
367	u_int16_t parseicmpspec(char *, sa_family_t);
368	int kw_casecmp(const void , const void );
369	int map_tos(char string, int );
370	int lookup_rtable(u_int);
371	int filteropts_to_rule(struct pf_rule , struct filter_opts );
372
373	TAILQ_HEAD(loadanchorshead, loadanchors)struct loadanchorshead { struct loadanchors tqh_first; struct loadanchors *tqh_last; }
374	loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead){ ((void *)0), &(loadanchorshead).tqh_first };
375
376	struct loadanchors {
377	TAILQ_ENTRY(loadanchors)struct { struct loadanchors tqe_next; struct loadanchors *tqe_prev ; } entries;
378	char *anchorname;
379	char *filename;
380	};
381
382	typedef struct {
383	union {
384	int64_t number;
385	double probability;
386	int i;
387	char *string;
388	u_int rtableid;
389	u_int16_t weight;
390	struct {
391	u_int8_t b1;
392	u_int8_t b2;
393	u_int16_t w;
394	u_int16_t w2;
395	} b;
396	struct range range;
397	struct node_if *interface;
398	struct node_proto *proto;
399	struct node_icmp *icmp;
400	struct node_host *host;
401	struct node_os *os;
402	struct node_port *port;
403	struct node_uid *uid;
404	struct node_gid *gid;
405	struct node_state_opt *state_opt;
406	struct peer peer;
407	struct {
408	struct peer src, dst;
409	struct node_os *src_os;
410	} fromto;
411	struct redirection *redirection;
412	struct {
413	int action;
414	struct node_state_opt *options;
415	} keep_state;
416	struct {
417	u_int8_t log;
418	u_int8_t logif;
419	u_int8_t quick;
420	} logquick;
421	struct {
422	int neg;
423	char *name;
424	} tagged;
425	struct pf_poolhashkey *hashkey;
426	struct node_queue *queue;
427	struct node_queue_opt queue_options;
428	struct node_queue_bw queue_bwspec;
429	struct node_qassign qassign;
430	struct node_sc sc;
431	struct filter_opts filter_opts;
432	struct antispoof_opts antispoof_opts;
433	struct queue_opts queue_opts;
434	struct scrub_opts scrub_opts;
435	struct table_opts table_opts;
436	struct pool_opts pool_opts;
437	struct node_hfsc_opts hfsc_opts;
438	struct pfctl_watermarks *watermarks;
439	} v;
440	int lineno;
441	} YYSTYPE;
442
443	#define PPORT_RANGE1 1
444	#define PPORT_STAR2 2
445	int parseport(char , struct range r, int);
446
447	#define DYNIF_MULTIADDR(addr)((addr).type == PF_ADDR_DYNIFTL && (!((addr).iflags & 0x08) \|\| !isdigit((unsigned char)(addr).v.ifname[strlen((addr ).v.ifname)-1]))) ((addr).type == PF_ADDR_DYNIFTL && \
448	(!((addr).iflags & PFI_AFLAG_NOALIAS0x08) \|\| \
449	!isdigit((unsigned char)(addr).v.ifname[strlen((addr).v.ifname)-1])))
450
451	#line 452 "parse.c"
452	#define PASS257 257
453	#define BLOCK258 258
454	#define MATCH259 259
455	#define SCRUB260 260
456	#define RETURN261 261
457	#define IN262 262
458	#define OS263 263
459	#define OUT264 264
460	#define LOG265 265
461	#define QUICK266 266
462	#define ON267 267
463	#define FROM268 268
464	#define TO269 269
465	#define FLAGS270 270
466	#define RETURNRST271 271
467	#define RETURNICMP272 272
468	#define RETURNICMP6273 273
469	#define PROTO274 274
470	#define INET275 275
471	#define INET6276 276
472	#define ALL277 277
473	#define ANY278 278
474	#define ICMPTYPE279 279
475	#define ICMP6TYPE280 280
476	#define CODE281 281
477	#define KEEP282 282
478	#define MODULATE283 283
479	#define STATE284 284
480	#define PORT285 285
481	#define BINATTO286 286
482	#define NODF287 287
483	#define MINTTL288 288
484	#define ERROR289 289
485	#define ALLOWOPTS290 290
486	#define FILENAME291 291
487	#define ROUTETO292 292
488	#define DUPTO293 293
489	#define REPLYTO294 294
490	#define NO295 295
491	#define LABEL296 296
492	#define NOROUTE297 297
493	#define URPFFAILED298 298
494	#define FRAGMENT299 299
495	#define USER300 300
496	#define GROUP301 301
497	#define MAXMSS302 302
498	#define MAXIMUM303 303
499	#define TTL304 304
500	#define TOS305 305
501	#define DROP306 306
502	#define TABLE307 307
503	#define REASSEMBLE308 308
504	#define ANCHOR309 309
505	#define SYNCOOKIES310 310
506	#define SET311 311
507	#define OPTIMIZATION312 312
508	#define TIMEOUT313 313
509	#define LIMIT314 314
510	#define LOGINTERFACE315 315
511	#define BLOCKPOLICY316 316
512	#define RANDOMID317 317
513	#define SYNPROXY318 318
514	#define FINGERPRINTS319 319
515	#define NOSYNC320 320
516	#define DEBUG321 321
517	#define SKIP322 322
518	#define HOSTID323 323
519	#define ANTISPOOF324 324
520	#define FOR325 325
521	#define INCLUDE326 326
522	#define MATCHES327 327
523	#define BITMASK328 328
524	#define RANDOM329 329
525	#define SOURCEHASH330 330
526	#define ROUNDROBIN331 331
527	#define LEASTSTATES332 332
528	#define STATICPORT333 333
529	#define PROBABILITY334 334
530	#define WEIGHT335 335
531	#define BANDWIDTH336 336
532	#define FLOWS337 337
533	#define QUANTUM338 338
534	#define QUEUE339 339
535	#define PRIORITY340 340
536	#define QLIMIT341 341
537	#define RTABLE342 342
538	#define RDOMAIN343 343
539	#define MINIMUM344 344
540	#define BURST345 345
541	#define PARENT346 346
542	#define LOAD347 347
543	#define RULESET_OPTIMIZATION348 348
544	#define PRIO349 349
545	#define ONCE350 350
546	#define DEFAULT351 351
547	#define DELAY352 352
548	#define STICKYADDRESS353 353
549	#define MAXSRCSTATES354 354
550	#define MAXSRCNODES355 355
551	#define SOURCETRACK356 356
552	#define GLOBAL357 357
553	#define RULE358 358
554	#define MAXSRCCONN359 359
555	#define MAXSRCCONNRATE360 360
556	#define OVERLOAD361 361
557	#define FLUSH362 362
558	#define SLOPPY363 363
559	#define PFLOW364 364
560	#define MAXPKTRATE365 365
561	#define TAGGED366 366
562	#define TAG367 367
563	#define IFBOUND368 368
564	#define FLOATING369 369
565	#define STATEPOLICY370 370
566	#define STATEDEFAULTS371 371
567	#define ROUTE372 372
568	#define DIVERTTO373 373
569	#define DIVERTREPLY374 374
570	#define DIVERTPACKET375 375
571	#define NATTO376 376
572	#define AFTO377 377
573	#define RDRTO378 378
574	#define RECEIVEDON379 379
575	#define NE380 380
576	#define LE381 381
577	#define GE382 382
578	#define STRING383 383
579	#define NUMBER384 384
580	#define PORTBINARY385 385
581	#define YYERRCODE256 256
582	const short yylhs[] =
583	{ -1,
584	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
585	0, 0, 0, 114, 123, 123, 123, 123, 18, 13,
586	13, 115, 115, 115, 115, 115, 115, 115, 115, 115,
587	115, 115, 115, 115, 115, 115, 115, 115, 115, 19,
588	113, 129, 113, 130, 130, 132, 71, 71, 73, 73,
589	74, 74, 75, 75, 120, 72, 72, 133, 133, 133,
590	133, 133, 135, 134, 134, 117, 118, 136, 104, 106,
591	106, 105, 105, 105, 105, 105, 121, 85, 85, 86,
592	86, 87, 87, 137, 96, 96, 98, 98, 97, 97,
593	11, 11, 122, 138, 107, 107, 109, 109, 108, 108,
594	108, 108, 54, 54, 53, 53, 119, 139, 99, 101,
595	101, 100, 100, 100, 100, 100, 100, 102, 102, 102,
596	102, 102, 103, 103, 89, 89, 116, 140, 90, 90,
597	92, 92, 91, 91, 91, 91, 91, 91, 91, 91,
598	91, 91, 91, 91, 91, 91, 91, 91, 91, 91,
599	91, 91, 91, 91, 91, 91, 91, 91, 91, 91,
600	91, 91, 91, 93, 93, 95, 95, 94, 94, 94,
601	94, 28, 28, 14, 14, 24, 24, 24, 27, 27,
602	27, 27, 27, 27, 27, 27, 27, 27, 42, 42,
603	43, 43, 16, 16, 16, 81, 81, 80, 80, 80,
604	80, 80, 82, 82, 83, 83, 84, 84, 84, 84,
605	1, 1, 1, 2, 2, 3, 4, 4, 4, 17,
606	17, 17, 33, 33, 33, 34, 34, 35, 36, 36,
607	44, 44, 57, 57, 57, 58, 59, 59, 46, 46,
608	47, 47, 45, 45, 45, 125, 125, 48, 48, 48,
609	52, 52, 49, 49, 49, 15, 15, 50, 50, 50,
610	50, 50, 50, 50, 50, 5, 5, 51, 60, 60,
611	61, 61, 62, 62, 62, 29, 31, 63, 63, 64,
612	64, 65, 65, 65, 8, 8, 66, 66, 67, 67,
613	68, 68, 68, 9, 9, 26, 25, 25, 25, 37,
614	37, 37, 37, 38, 38, 40, 40, 39, 39, 39,
615	41, 41, 41, 6, 6, 7, 7, 10, 10, 20,
616	20, 20, 23, 23, 76, 76, 76, 76, 21, 21,
617	21, 77, 77, 78, 78, 79, 79, 79, 79, 79,
618	79, 79, 79, 79, 79, 79, 79, 70, 88, 88,
619	88, 30, 56, 56, 55, 55, 69, 69, 32, 32,
620	142, 110, 110, 112, 112, 111, 111, 111, 111, 111,
621	111, 111, 141, 124, 126, 126, 127, 128, 128, 131,
622	131, 12, 12, 22, 22, 22, 22, 22, 22,
623	};
624	const short yylen[] =
625	{ 2,
626	0, 3, 2, 3, 3, 3, 3, 3, 3, 3,
627	3, 4, 3, 2, 2, 3, 3, 3, 1, 0,
628	1, 4, 3, 3, 3, 6, 3, 6, 3, 3,
629	3, 3, 3, 3, 3, 3, 3, 3, 4, 1,
630	0, 0, 4, 3, 1, 2, 1, 1, 2, 1,
631	2, 1, 1, 1, 3, 1, 0, 0, 2, 3,
632	3, 3, 0, 5, 0, 10, 5, 0, 2, 3,
633	1, 1, 2, 2, 2, 1, 5, 2, 5, 2,
634	4, 1, 3, 0, 2, 0, 2, 1, 2, 2,
635	1, 0, 5, 0, 2, 0, 2, 1, 1, 3,
636	4, 2, 2, 4, 2, 4, 4, 0, 2, 2,
637	1, 3, 2, 1, 2, 2, 2, 0, 3, 3,
638	6, 6, 1, 5, 1, 1, 8, 0, 2, 0,
639	2, 1, 2, 2, 1, 1, 2, 2, 1, 1,
640	1, 2, 2, 2, 3, 2, 2, 4, 1, 3,
641	4, 3, 5, 8, 3, 3, 2, 2, 2, 3,
642	1, 4, 1, 4, 2, 3, 1, 1, 2, 2,
643	2, 2, 6, 1, 1, 1, 1, 2, 0, 1,
644	1, 5, 1, 1, 4, 4, 6, 1, 1, 1,
645	1, 1, 0, 1, 1, 0, 1, 0, 1, 1,
646	2, 2, 1, 4, 1, 3, 1, 1, 1, 2,
647	0, 2, 5, 2, 4, 2, 1, 1, 2, 0,
648	1, 1, 0, 2, 5, 2, 4, 1, 1, 1,
649	1, 3, 0, 2, 5, 1, 2, 4, 0, 2,
650	0, 2, 1, 3, 2, 2, 0, 1, 1, 4,
651	2, 4, 2, 2, 2, 2, 0, 1, 3, 3,
652	3, 1, 3, 3, 2, 1, 1, 3, 1, 4,
653	2, 4, 1, 2, 3, 1, 1, 1, 4, 2,
654	4, 1, 2, 3, 1, 1, 1, 4, 2, 4,
655	1, 2, 3, 1, 1, 1, 4, 3, 2, 2,
656	5, 2, 5, 2, 4, 2, 4, 1, 3, 3,
657	1, 3, 3, 1, 1, 1, 1, 1, 1, 0,
658	1, 1, 1, 1, 2, 3, 3, 3, 0, 1,
659	2, 3, 0, 1, 3, 2, 1, 2, 2, 4,
660	5, 2, 2, 1, 1, 1, 2, 1, 1, 3,
661	5, 1, 2, 4, 3, 5, 1, 3, 0, 1,
662	0, 2, 0, 2, 1, 1, 1, 2, 1, 1,
663	1, 1, 2, 2, 4, 2, 2, 4, 2, 1,
664	0, 1, 1, 1, 1, 1, 1, 1, 1,
665	};
666	const short yydefred[] =
667	{ 0,
668	0, 0, 0, 0, 176, 0, 177, 0, 0, 0,
669	0, 0, 0, 0, 0, 3, 0, 0, 0, 0,
670	0, 0, 0, 0, 0, 0, 0, 15, 0, 0,
671	0, 13, 188, 0, 0, 0, 180, 178, 0, 56,
672	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
673	0, 0, 0, 0, 0, 0, 0, 0, 0, 14,
674	0, 0, 0, 194, 195, 0, 2, 4, 5, 6,
675	7, 8, 9, 10, 11, 18, 12, 17, 16, 0,
676	0, 0, 0, 0, 382, 383, 0, 40, 0, 23,
677	0, 0, 25, 0, 0, 27, 48, 47, 29, 32,
678	31, 33, 36, 35, 0, 37, 267, 266, 30, 0,
679	24, 19, 323, 324, 34, 0, 337, 0, 0, 0,
680	0, 0, 0, 345, 346, 0, 344, 0, 334, 0,
681	202, 0, 0, 201, 108, 0, 54, 53, 55, 0,
682	0, 0, 189, 190, 0, 191, 192, 0, 0, 197,
683	0, 21, 22, 39, 0, 374, 0, 0, 377, 0,
684	0, 91, 212, 0, 49, 336, 338, 342, 321, 322,
685	343, 339, 0, 0, 347, 380, 0, 0, 207, 209,
686	208, 0, 205, 218, 0, 217, 0, 0, 82, 78,
687	221, 222, 0, 107, 0, 0, 51, 0, 0, 185,
688	0, 186, 93, 0, 0, 0, 246, 0, 0, 0,
689	0, 0, 216, 0, 0, 335, 210, 204, 0, 219,
690	0, 0, 77, 0, 0, 0, 0, 0, 0, 114,
691	111, 0, 67, 0, 182, 0, 0, 99, 0, 98,
692	0, 0, 0, 0, 45, 376, 26, 0, 379, 28,
693	0, 0, 0, 340, 0, 206, 0, 0, 83, 0,
694	0, 88, 0, 125, 126, 0, 0, 116, 117, 115,
695	113, 110, 0, 0, 187, 102, 0, 97, 0, 46,
696	43, 0, 0, 0, 213, 0, 214, 0, 341, 79,
697	0, 80, 348, 89, 90, 87, 0, 112, 0, 229,
698	230, 0, 224, 228, 0, 231, 0, 0, 0, 100,
699	0, 0, 0, 0, 0, 44, 375, 378, 0, 331,
700	0, 0, 0, 0, 0, 248, 0, 0, 240, 0,
701	249, 127, 0, 0, 0, 0, 254, 255, 0, 0,
702	0, 0, 0, 253, 0, 0, 103, 101, 0, 105,
703	0, 215, 81, 0, 0, 0, 0, 0, 385, 386,
704	388, 0, 384, 387, 389, 0, 0, 245, 269, 277,
705	0, 0, 0, 0, 0, 0, 0, 0, 0, 141,
706	0, 0, 0, 0, 0, 140, 0, 0, 0, 0,
707	0, 0, 0, 0, 0, 161, 0, 0, 0, 149,
708	0, 0, 0, 0, 0, 135, 136, 139, 132, 0,
709	163, 236, 0, 234, 0, 232, 0, 265, 0, 0,
710	0, 0, 0, 0, 256, 0, 63, 66, 124, 0,
711	0, 225, 0, 226, 0, 274, 0, 0, 0, 244,
712	68, 299, 296, 0, 0, 314, 315, 0, 0, 300,
713	316, 317, 0, 0, 302, 0, 0, 0, 0, 0,
714	0, 0, 157, 159, 158, 325, 142, 285, 286, 0,
715	0, 0, 133, 278, 294, 295, 0, 0, 0, 134,
716	287, 318, 319, 138, 0, 0, 0, 0, 0, 168,
717	165, 0, 174, 175, 146, 349, 0, 143, 147, 137,
718	0, 144, 0, 0, 0, 0, 0, 0, 0, 131,
719	0, 242, 104, 260, 259, 261, 268, 264, 263, 106,
720	0, 0, 0, 0, 0, 0, 275, 251, 250, 0,
721	0, 0, 298, 0, 0, 0, 0, 0, 0, 326,
722	327, 0, 353, 0, 156, 0, 373, 0, 0, 283,
723	0, 0, 292, 170, 169, 172, 0, 171, 167, 0,
724	328, 0, 0, 0, 150, 276, 152, 0, 155, 145,
725	160, 0, 0, 58, 122, 121, 227, 270, 0, 271,
726	0, 151, 72, 0, 0, 0, 76, 71, 0, 297,
727	0, 0, 309, 310, 0, 0, 312, 313, 0, 0,
728	0, 358, 352, 366, 367, 0, 369, 370, 371, 372,
729	365, 0, 0, 0, 284, 0, 0, 293, 0, 164,
730	0, 350, 0, 162, 148, 0, 237, 235, 0, 0,
731	0, 252, 73, 74, 75, 0, 301, 0, 304, 303,
732	0, 306, 332, 0, 354, 0, 368, 360, 364, 279,
733	0, 280, 288, 0, 289, 0, 166, 0, 0, 0,
734	59, 64, 0, 0, 0, 272, 70, 0, 0, 355,
735	0, 0, 0, 0, 351, 0, 238, 62, 60, 61,
736	305, 307, 0, 281, 290, 173, 0, 356, 154,
737	};
738	const short yydgoto[] =
739	{ 2,
740	106, 252, 163, 189, 109, 449, 454, 471, 478, 484,
741	311, 87, 153, 495, 347, 66, 193, 111, 89, 171,
742	289, 366, 127, 17, 406, 445, 38, 490, 565, 602,
743	367, 647, 274, 357, 303, 304, 407, 591, 450, 595,
744	455, 145, 148, 307, 329, 308, 416, 330, 331, 459,
745	345, 439, 313, 314, 601, 460, 335, 414, 573, 368,
746	525, 369, 473, 613, 474, 480, 616, 481, 461, 294,
747	99, 41, 112, 139, 370, 408, 540, 128, 129, 58,
748	151, 59, 182, 183, 133, 257, 190, 498, 266, 332,
749	409, 410, 411, 491, 560, 223, 262, 263, 194, 231,
750	232, 298, 267, 531, 588, 589, 203, 240, 241, 545,
751	611, 612, 154, 18, 19, 20, 21, 22, 23, 24,
752	25, 26, 3, 93, 158, 209, 96, 211, 155, 244,
753	177, 245, 630, 428, 521, 532, 224, 204, 195, 333,
754	463, 546,
755	};
756	const short yysindex[] =
757	{ -21,
758	0, 300, 47, 59, 0, 389, 0, 52, -263, 3644,
759	-128, -172, -145, -27, 205, 0, 159, 267, 297, 316,
760	380, 393, 404, 420, 424, 432, 437, 0, 454, 458,
761	460, 0, 0, 277, 341, 416, 0, 0, 89, 0,
762	159, -195, 93, 114, -81, -65, -224, -51, 125, -158,
763	191, 118, 135, 175, 1200, 487, 258, 214, 294, 0,
764	191, -263, 229, 0, 0, -128, 0, 0, 0, 0,
765	0, 0, 0, 0, 0, 0, 0, 0, 0, 245,
766	236, 239, 500, 304, 0, 0, 291, 0, 0, 0,
767	221, 582, 0, 231, 582, 0, 0, 0, 0, 0,
768	0, 0, 0, 0, 58, 0, 0, 0, 0, 135,
769	0, 0, 0, 0, 0, 279, 0, 289, 301, 272,
770	312, 322, 534, 0, 0, 326, 0, 644, 0, -29,
771	0, -24, 365, 0, 0, 445, 0, 0, 0, 229,
772	191, 348, 0, 0, 208, 0, 0, 711, 0, 0,
773	191, 0, 0, 0, 714, 0, 582, 372, 0, 386,
774	582, 0, 0, -196, 0, 0, 0, 0, 0, 0,
775	0, 0, 725, 387, 0, 0, 1200, 135, 0, 0,
776	0, 399, 0, 0, 390, 0, 582, -196, 0, 0,
777	0, 0, 0, 0, 715, 135, 0, 365, 732, 0,
778	239, 0, 0, -92, 365, 397, 0, 582, 10, 582,
779	82, 743, 0, 409, 736, 0, 0, 0, -29, 0,
780	-11, 768, 0, -208, 265, 426, 427, 430, 440, 0,
781	0, 715, 0, 541, 0, 784, 447, 0, 582, 0,
782	-92, 541, 455, 408, 0, 0, 0, 372, 0, 0,
783	386, 105, 582, 0, 475, 0, 112, 582, 0, 461,
784	463, 0, -208, 0, 0, 507, 644, 0, 0, 0,
785	0, 0, -103, -123, 0, 0, 75, 0, -123, 0,
786	0, 397, 582, 582, 0, 743, 0, 488, 0, 0,
787	-11, 0, 0, 0, 0, 0, 265, 0, -76, 0,
788	0, 582, 0, 0, 56, 0, 0, 590, 582, 0,
789	234, 524, 120, 582, 0, 0, 0, 0, 582, 0,
790	582, 529, 265, 265, 271, 0, 597, 582, 0, 571,
791	0, 0, 5354, -53, 591, 62, 0, 0, 478, 401,
792	815, 484, 486, 0, 819, 502, 0, 0, 62, 0,
793	747, 0, 0, 506, 644, 644, 126, 582, 0, 0,
794	0, 582, 0, 0, 0, 229, 508, 0, 0, 0,
795	17, 597, 831, -34, -96, -75, 610, 611, 83, 0,
796	83, 83, 83, 615, 461, 0, 789, 836, 283, 392,
797	616, 288, -32, 517, 522, 0, 523, 135, 530, 0,
798	629, 83, 365, 83, -261, 0, 0, 0, 0, 5354,
799	0, 0, 582, 0, 56, 0, 160, 0, 531, 533,
800	537, 882, 862, 542, 0, 582, 0, 0, 0, 587,
801	630, 0, 271, 0, 868, 0, 229, 582, 164, 0,
802	0, 0, 0, 551, 888, 0, 0, 582, 658, 0,
803	0, 0, 582, 659, 0, 902, 902, 582, 524, 660,
804	0, 0, 0, 0, 0, 0, 0, 0, 0, 582,
805	558, 307, 0, 0, 0, 0, 582, 562, 310, 0,
806	0, 0, 0, 0, 283, -32, -30, 564, 225, 0,
807	0, 902, 0, 0, 0, 0, 566, 0, 0, 0,
808	903, 0, 667, 229, 0, 685, 0, 135, -196, 0,
809	572, 0, 0, 0, 0, 0, 0, 0, 0, 0,
810	944, 265, 265, 582, 197, 582, 0, 0, 0, 17,
811	915, 555, 0, 551, 321, 352, 354, 359, 1200, 0,
812	0, 102, 0, 229, 0, 632, 0, 934, 307, 0,
813	950, 310, 0, 0, 0, 0, 573, 0, 0, 446,
814	0, 527, 574, 229, 0, 0, 0, 83, 0, 0,
815	0, 582, 202, 0, 0, 0, 0, 0, 868, 0,
816	582, 0, 0, 583, 584, 586, 0, 0, 644, 0,
817	203, 582, 0, 0, 228, 582, 0, 0, 543, 524,
818	293, 0, 0, 0, 0, 135, 0, 0, 0, 0,
819	0, 632, 371, 582, 0, 373, 582, 0, 644, 0,
820	225, 0, 589, 0, 0, 0, 0, 0, 572, 559,
821	582, 0, 0, 0, 0, 555, 0, 321, 0, 0,
822	354, 0, 0, 582, 0, 102, 0, 0, 0, 0,
823	934, 0, 0, 950, 0, 592, 0, 925, 701, 582,
824	0, 0, 964, 972, 974, 0, 0, 582, 582, 0,
825	524, 582, 582, 946, 0, 83, 0, 0, 0, 0,
826	0, 0, 582, 0, 0, 0, 0, 0, 0,};
827	const short yyrindex[] =
828	{ 5,
829	0, 0, 0, 0, 0, 1497, 0, 0, 1617, 0,
830	650, 0, 0, 0, 0, 0, 2097, 0, 0, 0,
831	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
832	0, 0, 0, 1737, 1857, 1977, 0, 0, 0, 0,
833	2217, 0, 0, 0, 0, 0, 0, 0, 0, 0,
834	978, 0, 0, 0, 0, 2337, 2568, 0, 2688, 0,
835	733, 721, 0, 0, 0, 3279, 0, 0, 0, 0,
836	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
837	0, 0, 0, 2808, 0, 0, 980, 0, 210, 0,
838	0, 608, 0, 0, 608, 0, 0, 0, 0, 0,
839	0, 0, 0, 0, -186, 0, 0, 0, 0, 1377,
840	0, 0, 0, 0, 0, 0, 0, 0, 0, 37,
841	0, 0, 0, 0, 0, 0, 0, 519, 0, 0,
842	0, 0, 4, 0, 0, 0, 0, 0, 0, 988,
843	3630, 0, 0, 0, 362, 0, 0, 0, 2, 0,
844	3399, 0, 0, 0, 0, 0, 1251, 0, 0, 0,
845	-8, 0, 0, 0, 0, 0, 0, 0, 0, 0,
846	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
847	0, 374, 0, 0, 0, 0, 21, 0, 0, 0,
848	0, 0, 117, 0, 0, 0, 0, 3870, 0, 0,
849	0, 0, 0, 0, 3750, 0, 0, -9, 617, -9,
850	617, -186, 0, 0, 0, 0, 0, 0, 0, 0,
851	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
852	0, 989, 0, 4110, 0, 0, 0, 0, 27, 0,
853	991, 3990, 0, 617, 0, 0, 0, 0, 0, 0,
854	0, -5, 33, 0, 151, 0, 134, 521, 0, 0,
855	0, 0, 994, 0, 0, 581, 600, 0, 0, 0,
856	0, 0, 0, 4470, 0, 0, 367, 0, 4230, 0,
857	0, 0, -9, -9, 0, -186, 0, 472, 0, 0,
858	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
859	0, 382, 0, 0, 367, 0, 5253, 4581, 405, 0,
860	0, -1, 493, -14, 4821, 0, 0, 0, 33, 0,
861	521, 0, 0, 0, 0, 0, 0, 111, 0, 4350,
862	0, 0, -137, 0, 4931, 367, 0, 0, 0, 303,
863	0, 0, 0, 0, 429, 0, 0, 0, 367, 0,
864	997, 0, 0, 0, 204, 483, 362, 11, 0, 0,
865	0, 965, 0, 0, 0, 0, 723, 0, 0, 0,
866	367, 0, 0, 0, 0, 0, 0, 0, 0, 0,
867	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
868	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
869	0, 0, 740, 0, 0, 0, 0, 0, 0, 7,
870	0, 0, 608, 0, 367, 0, 493, 0, 0, 0,
871	0, 0, 0, 0, 0, -14, 0, 0, 0, 0,
872	0, 0, 0, 0, 0, 0, 0, -22, 163, 0,
873	0, 0, 0, 0, 0, 0, 0, 382, 1112, 0,
874	0, 0, 382, 1232, 0, 5051, 5051, 108, 2448, 2919,
875	3510, 3510, 0, 0, 0, 0, 0, 0, 0, 965,
876	848, 0, 0, 0, 0, 0, 965, 987, 0, 0,
877	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
878	0, 5051, 0, 0, 0, 0, 0, 0, 0, 0,
879	0, 0, 0, 0, 3510, 0, 3510, 0, 0, 0,
880	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
881	0, 0, 0, 11, 1053, 656, 0, 0, 0, 367,
882	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
883	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
884	0, 0, 0, 0, 0, 0, 0, 0, 0, 448,
885	0, 617, 0, 0, 0, 0, 0, 0, 0, 0,
886	0, -9, 617, 0, 0, 0, 0, 0, 0, 0,
887	-22, 0, 0, 0, 0, 0, 0, 0, 603, 0,
888	362, 11, 0, 0, 362, 11, 0, 0, 1465, -4,
889	153, 0, 0, 0, 0, 3039, 0, 0, 0, 0,
890	0, 4701, 1053, 656, 0, 1053, 656, 0, 637, 0,
891	0, 0, 0, 0, 0, 3159, 0, 0, 0, 0,
892	656, 0, 0, 0, 0, 0, 0, 0, 0, 0,
893	0, 0, 0, 53, 0, 0, 0, 0, 0, 0,
894	0, 0, 0, 0, 0, 0, 0, 0, 5152, -9,
895	0, 0, 0, 0, 0, 0, 0, 11, 11, 0,
896	-4, 656, 656, 0, 0, 0, 0, 0, 0, 0,
897	0, 0, 53, 0, 0, 0, 3510, 0, 0,};
898	const short yygindex[] =
899	{ 0,
900	71, 0, -133, -143, 0, 0, 0, -344, -372, 544,
901	-43, 0, 0, 0, -418, 973, 26, 0, 0, 0,
902	0, -312, 976, 0, 0, -358, 0, 0, 468, 0,
903	-235, 0, 791, 0, -260, 0, 0, 0, -472, 0,
904	-452, 0, 834, 763, 628, 0, 0, -347, 173, -227,
905	0, 0, 708, 696, 0, -124, 0, -474, 0, 674,
906	0, -412, 0, 0, -465, 0, 0, -477, -353, 665,
907	0, 992, -106, 918, -60, 0, -359, 516, 883, 993,
908	0, 1006, 0, 845, 0, 0, 57, 594, 770, 753,
909	666, 0, 0, -437, 0, 0, 812, 0, 0, 846,
910	0, 0, -290, 0, 441, 0, 0, 840, 0, -366,
911	470, 0, 0, 453, 0, -3, -2, 0, 0, 0,
912	0, 0, 0, -54, -93, 0, -50, 0, 0, 0,
913	-138, 803, 0, 0, 0, 0, 0, 0, 0, 0,
914	366, 0,
915	};
916	#define YYTABLESIZE5732 5732
917	const short yytable[] =
918	{ 30,
919	31, 160, 140, 165, 1, 257, 201, 497, 257, 557,
920	247, 96, 444, 220, 1, 188, 129, 247, 247, 302,
921	213, 247, 526, 438, 247, 247, 448, 381, 188, 247,
922	239, 257, 355, 356, 247, 257, 572, 247, 257, 257,
923	543, 92, 257, 219, 222, 247, 320, 453, 505, 162,
924	507, 559, 97, 176, 247, 257, 28, 95, 257, 247,
925	247, 164, 592, 207, 358, 247, 247, 212, 32, 413,
926	248, 217, 251, 617, 472, 479, 247, 320, 253, 140,
927	320, 184, 614, 344, 596, 533, 247, 260, 162, 233,
928	162, 92, 247, 221, 162, 547, 247, 541, 187, 85,
929	247, 1, 247, 208, 508, 282, 553, 162, 247, 210,
930	247, 39, 247, 286, 246, 247, 249, 509, 291, 40,
931	257, 257, 342, 257, 94, 176, 86, 550, 299, 129,
932	436, 135, 561, 261, 247, 247, 56, 57, 567, 328,
933	569, 342, 343, 247, 305, 277, 185, 247, 176, 247,
934	247, 247, 319, 306, 660, 176, 92, 247, 98, 287,
935	329, 343, 103, 176, 292, 668, 631, 247, 164, 176,
936	247, 29, 524, 381, 349, 590, 673, 247, 328, 618,
937	161, 644, 581, 657, 309, 672, 186, 86, 669, 317,
938	318, 329, 381, 283, 329, 381, 92, 309, 237, 310,
939	284, 527, 381, 176, 615, 458, 250, 176, 325, 100,
940	60, 198, 381, 120, 626, 336, 430, 431, 433, 41,
941	350, 205, 381, 234, 104, 352, 323, 353, 92, 285,
942	242, 575, 576, 247, 371, 472, 290, 61, 479, 178,
943	176, 92, 164, 442, 348, 176, 176, 179, 200, 42,
944	432, 176, 683, 184, 101, 247, 462, 462, 462, 659,
945	1, 1, 1, 1, 434, 63, 184, 324, 435, 247,
946	180, 176, 381, 342, 247, 247, 67, 258, 349, 300,
947	301, 62, 247, 247, 513, 381, 446, 447, 529, 405,
948	238, 502, 94, 343, 326, 257, 257, 181, 247, 220,
949	530, 91, 27, 5, 6, 7, 68, 451, 452, 16,
950	247, 1, 258, 1, 600, 1, 80, 94, 185, 511,
951	689, 578, 687, 247, 247, 69, 628, 637, 1, 412,
952	1, 185, 520, 326, 247, 258, 176, 381, 472, 320,
953	327, 479, 258, 1, 528, 220, 258, 321, 443, 247,
954	496, 1, 640, 556, 535, 9, 320, 247, 186, 537,
955	247, 247, 258, 247, 542, 571, 405, 257, 247, 247,
956	257, 186, 92, 247, 247, 247, 548, 381, 257, 257,
957	81, 257, 257, 551, 94, 92, 579, 1, 247, 70,
958	320, 320, 320, 247, 247, 320, 320, 320, 247, 320,
959	320, 570, 71, 247, 320, 320, 92, 247, 247, 247,
960	247, 381, 84, 72, 176, 247, 176, 645, 671, 320,
961	64, 621, 65, 623, 247, 258, 92, 258, 506, 73,
962	577, 489, 580, 74, 629, 247, 247, 247, 262, 218,
963	381, 75, 176, 566, 247, 420, 76, 419, 281, 312,
964	636, 176, 638, 329, 339, 82, 641, 105, 84, 381,
965	381, 262, 646, 77, 247, 340, 341, 78, 262, 79,
966	329, 83, 262, 339, 651, 88, 381, 654, 627, 247,
967	656, 330, 247, 603, 340, 341, 620, 632, 262, 176,
968	247, 247, 119, 247, 247, 650, 90, 653, 639, 648,
969	107, 108, 642, 566, 329, 329, 329, 102, 312, 329,
970	329, 329, 330, 329, 329, 330, 381, 110, 329, 329,
971	652, 312, 56, 655, 381, 381, 130, 247, 38, 485,
972	337, 338, 381, 329, 381, 381, 381, 666, 132, 120,
973	120, 120, 113, 114, 120, 381, 381, 381, 142, 120,
974	670, 262, 381, 262, 120, 4, 5, 6, 7, 134,
975	247, 149, 258, 486, 247, 258, 677, 622, 661, 150,
976	176, 258, 258, 487, 681, 682, 488, 152, 684, 685,
977	258, 258, 258, 643, 258, 258, 176, 258, 258, 688,
978	123, 157, 258, 174, 258, 258, 258, 258, 258, 258,
979	258, 258, 258, 258, 156, 339, 8, 258, 9, 118,
980	10, 137, 138, 258, 159, 381, 340, 341, 143, 144,
981	258, 146, 147, 11, 123, 12, 664, 665, 169, 170,
982	258, 258, 258, 258, 258, 258, 258, 258, 13, 191,
983	192, 258, 381, 69, 258, 247, 14, 264, 265, 33,
984	381, 258, 258, 300, 301, 258, 364, 363, 365, 34,
985	35, 36, 166, 92, 92, 482, 483, 258, 258, 258,
986	493, 494, 167, 381, 258, 258, 258, 258, 258, 258,
987	258, 258, 15, 662, 168, 258, 258, 176, 262, 468,
988	469, 262, 475, 476, 37, 172, 485, 262, 262, 247,
989	381, 247, 247, 446, 447, 173, 262, 262, 262, 175,
990	262, 262, 196, 262, 262, 247, 247, 247, 262, 362,
991	262, 262, 262, 262, 262, 262, 262, 262, 262, 262,
992	486, 199, 273, 262, 593, 594, 451, 452, 92, 262,
993	487, 597, 598, 488, 381, 381, 262, 464, 465, 92,
994	92, 202, 381, 206, 91, 273, 262, 262, 262, 262,
995	262, 262, 262, 262, 247, 247, 273, 262, 94, 215,
996	262, 214, 235, 220, 330, 162, 247, 262, 262, 243,
997	247, 262, 273, 273, 273, 381, 381, 247, 247, 381,
998	381, 330, 254, 262, 262, 262, 381, 255, 247, 381,
999	262, 262, 262, 262, 262, 262, 262, 262, 259, 268,
1000	269, 262, 262, 270, 273, 5, 6, 7, 119, 119,
1001	119, 381, 271, 119, 275, 330, 330, 330, 119, 276,
1002	330, 330, 330, 119, 330, 330, 288, 280, 381, 330,
1003	330, 583, 584, 293, 320, 273, 295, 273, 364, 363,
1004	365, 297, 334, 354, 330, 372, 585, 282, 346, 415,
1005	418, 421, 586, 247, 381, 424, 422, 9, 423, 427,
1006	441, 587, 381, 381, 381, 381, 381, 381, 381, 381,
1007	282, 381, 381, 123, 12, 425, 381, 381, 429, 381,
1008	381, 282, 437, 456, 457, 364, 363, 365, 466, 492,
1009	499, 381, 381, 247, 381, 500, 501, 282, 282, 282,
1010	381, 470, 503, 504, 514, 515, 123, 123, 123, 381,
1011	516, 123, 517, 518, 123, 519, 123, 364, 363, 365,
1012	522, 123, 523, 443, 534, 118, 118, 118, 536, 538,
1013	118, 539, 549, 381, 544, 118, 552, 558, 562, 563,
1014	118, 564, 568, 574, 412, 582, 619, 624, 477, 604,
1015	605, 606, 607, 608, 609, 675, 633, 634, 635, 676,
1016	282, 658, 282, 678, 198, 674, 359, 360, 361, 137,
1017	138, 679, 273, 680, 610, 273, 686, 211, 57, 20,
1018	247, 273, 273, 364, 363, 365, 291, 52, 109, 381,
1019	95, 273, 273, 85, 273, 273, 65, 220, 273, 364,
1020	363, 365, 273, 84, 273, 273, 273, 273, 273, 291,
1021	381, 273, 273, 273, 247, 247, 247, 273, 554, 115,
1022	291, 625, 279, 273, 236, 247, 247, 247, 247, 247,
1023	273, 315, 512, 417, 426, 440, 291, 291, 291, 467,
1024	225, 226, 227, 136, 599, 228, 273, 197, 141, 216,
1025	229, 273, 131, 256, 273, 230, 322, 351, 211, 211,
1026	211, 273, 273, 211, 296, 510, 667, 272, 211, 555,
1027	278, 649, 663, 211, 316, 0, 0, 273, 273, 273,
1028	0, 0, 0, 0, 0, 273, 273, 273, 273, 273,
1029	273, 273, 273, 273, 273, 273, 273, 282, 0, 291,
1030	0, 291, 381, 381, 381, 0, 0, 282, 0, 0,
1031	0, 308, 0, 0, 0, 0, 282, 282, 0, 282,
1032	282, 0, 0, 282, 0, 0, 0, 282, 0, 282,
1033	282, 282, 282, 282, 308, 0, 282, 282, 282, 0,
1034	0, 0, 282, 0, 0, 308, 0, 0, 282, 0,
1035	0, 0, 0, 0, 0, 282, 0, 0, 359, 360,
1036	361, 468, 469, 0, 0, 0, 0, 0, 0, 0,
1037	0, 282, 0, 0, 0, 0, 282, 0, 0, 282,
1038	0, 0, 0, 0, 0, 0, 282, 282, 0, 0,
1039	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1040	0, 0, 282, 282, 282, 359, 360, 361, 475, 476,
1041	282, 282, 282, 282, 282, 282, 282, 282, 282, 282,
1042	282, 282, 0, 0, 308, 0, 308, 0, 0, 0,
1043	0, 311, 0, 0, 0, 0, 291, 359, 360, 361,
1044	137, 138, 0, 0, 0, 0, 291, 0, 0, 0,
1045	0, 0, 0, 0, 311, 291, 291, 0, 291, 291,
1046	0, 0, 291, 0, 0, 311, 291, 0, 291, 291,
1047	291, 291, 291, 247, 0, 291, 291, 291, 0, 0,
1048	247, 291, 0, 0, 247, 0, 0, 291, 0, 0,
1049	0, 0, 0, 0, 291, 0, 0, 0, 0, 0,
1050	247, 247, 247, 359, 360, 361, 468, 469, 0, 0,
1051	291, 0, 0, 0, 0, 291, 0, 0, 291, 359,
1052	360, 361, 475, 476, 0, 291, 291, 0, 0, 0,
1053	0, 0, 0, 0, 247, 247, 247, 247, 247, 0,
1054	0, 291, 291, 291, 311, 0, 311, 0, 0, 291,
1055	291, 291, 291, 291, 291, 291, 291, 291, 291, 291,
1056	291, 308, 0, 247, 0, 247, 0, 0, 0, 0,
1057	0, 308, 0, 0, 0, 0, 50, 0, 0, 0,
1058	308, 308, 0, 308, 308, 0, 0, 308, 0, 0,
1059	0, 308, 0, 308, 308, 308, 308, 308, 0, 50,
1060	308, 308, 308, 0, 0, 0, 308, 50, 0, 0,
1061	50, 0, 308, 0, 0, 0, 0, 0, 0, 308,
1062	0, 0, 381, 381, 381, 381, 381, 0, 0, 0,
1063	0, 0, 0, 0, 0, 308, 0, 0, 0, 0,
1064	308, 0, 0, 308, 0, 0, 0, 0, 0, 0,
1065	308, 308, 0, 0, 0, 0, 0, 0, 0, 0,
1066	0, 0, 0, 0, 0, 0, 308, 308, 308, 0,
1067	0, 0, 0, 0, 308, 308, 308, 308, 308, 308,
1068	308, 311, 0, 0, 308, 308, 0, 0, 0, 50,
1069	0, 311, 116, 0, 0, 0, 179, 0, 0, 0,
1070	311, 311, 0, 311, 311, 0, 0, 311, 0, 117,
1071	0, 311, 0, 311, 311, 311, 311, 311, 247, 179,
1072	311, 311, 311, 0, 0, 0, 311, 0, 0, 0,
1073	0, 0, 311, 0, 0, 0, 0, 247, 247, 311,
1074	0, 0, 0, 118, 119, 120, 0, 0, 121, 122,
1075	123, 0, 124, 125, 0, 311, 0, 113, 114, 0,
1076	311, 0, 0, 311, 0, 0, 0, 0, 0, 0,
1077	311, 311, 126, 0, 0, 0, 0, 0, 0, 0,
1078	0, 0, 0, 247, 0, 0, 311, 311, 311, 0,
1079	0, 0, 0, 0, 311, 311, 311, 311, 311, 311,
1080	311, 0, 0, 0, 311, 311, 0, 0, 0, 0,
1081	0, 0, 247, 0, 0, 0, 57, 0, 0, 0,
1082	247, 247, 247, 247, 247, 0, 50, 0, 0, 0,
1083	0, 0, 0, 0, 0, 50, 50, 0, 0, 57,
1084	0, 0, 0, 50, 0, 50, 50, 0, 50, 50,
1085	0, 0, 50, 0, 0, 0, 50, 0, 50, 50,
1086	50, 50, 50, 0, 0, 50, 50, 50, 0, 0,
1087	0, 50, 0, 0, 0, 0, 0, 50, 0, 0,
1088	0, 0, 0, 0, 50, 0, 0, 0, 0, 0,
1089	0, 0, 0, 50, 50, 50, 50, 50, 50, 50,
1090	50, 0, 0, 0, 0, 50, 0, 0, 50, 0,
1091	0, 0, 0, 0, 0, 50, 50, 0, 0, 50,
1092	0, 0, 0, 0, 0, 0, 0, 0, 0, 57,
1093	0, 50, 50, 50, 0, 0, 181, 0, 0, 50,
1094	50, 50, 50, 50, 50, 50, 179, 0, 179, 179,
1095	179, 179, 179, 179, 179, 179, 179, 381, 0, 181,
1096	179, 179, 179, 179, 0, 179, 179, 0, 179, 179,
1097	0, 0, 179, 0, 381, 0, 179, 0, 179, 179,
1098	179, 179, 179, 0, 0, 179, 179, 179, 0, 0,
1099	0, 179, 0, 0, 0, 0, 0, 179, 0, 0,
1100	0, 0, 0, 0, 179, 0, 0, 0, 381, 381,
1101	381, 0, 0, 381, 381, 381, 0, 381, 381, 0,
1102	179, 0, 381, 381, 0, 179, 0, 0, 179, 0,
1103	0, 0, 0, 0, 0, 179, 179, 381, 0, 0,
1104	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1105	0, 179, 179, 179, 0, 0, 183, 0, 0, 179,
1106	179, 179, 179, 179, 179, 179, 57, 0, 57, 57,
1107	57, 0, 57, 57, 57, 57, 57, 0, 0, 183,
1108	57, 57, 57, 57, 0, 57, 57, 0, 57, 57,
1109	0, 0, 57, 0, 0, 0, 57, 0, 57, 57,
1110	57, 57, 57, 0, 0, 57, 57, 57, 0, 0,
1111	0, 57, 0, 0, 0, 0, 0, 57, 0, 0,
1112	0, 0, 0, 0, 57, 0, 0, 0, 0, 0,
1113	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1114	57, 0, 0, 0, 0, 57, 0, 0, 57, 0,
1115	0, 0, 0, 0, 0, 57, 57, 0, 0, 0,
1116	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1117	0, 57, 57, 57, 0, 0, 184, 0, 0, 57,
1118	57, 57, 57, 57, 57, 57, 181, 0, 181, 181,
1119	181, 181, 181, 181, 181, 181, 181, 0, 0, 184,
1120	181, 181, 181, 181, 0, 181, 181, 0, 181, 181,
1121	0, 0, 181, 0, 0, 0, 181, 0, 181, 181,
1122	181, 181, 181, 0, 0, 181, 181, 181, 0, 0,
1123	0, 181, 0, 0, 0, 0, 0, 181, 0, 0,
1124	0, 0, 0, 0, 181, 0, 0, 0, 0, 0,
1125	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1126	181, 0, 0, 0, 0, 181, 0, 0, 181, 0,
1127	0, 0, 0, 0, 0, 181, 181, 0, 0, 0,
1128	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1129	0, 181, 181, 181, 0, 0, 193, 0, 0, 181,
1130	181, 181, 181, 181, 181, 181, 183, 0, 183, 183,
1131	183, 183, 183, 183, 183, 183, 183, 0, 0, 193,
1132	183, 183, 183, 183, 0, 183, 183, 0, 183, 183,
1133	0, 0, 183, 0, 0, 0, 183, 0, 183, 183,
1134	183, 183, 183, 0, 0, 183, 183, 183, 0, 0,
1135	0, 183, 0, 0, 0, 0, 0, 183, 0, 0,
1136	0, 0, 0, 0, 183, 0, 0, 0, 0, 0,
1137	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1138	183, 0, 0, 0, 0, 183, 0, 0, 183, 0,
1139	0, 0, 0, 0, 0, 183, 183, 0, 0, 0,
1140	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1141	0, 183, 183, 183, 0, 0, 193, 0, 0, 183,
1142	183, 183, 183, 183, 183, 183, 184, 0, 184, 184,
1143	184, 184, 184, 184, 184, 184, 184, 0, 0, 193,
1144	184, 184, 184, 184, 0, 184, 184, 0, 184, 184,
1145	0, 0, 184, 0, 0, 0, 184, 0, 184, 184,
1146	184, 184, 184, 0, 0, 184, 184, 184, 0, 0,
1147	0, 184, 0, 0, 0, 0, 0, 184, 0, 0,
1148	0, 0, 0, 0, 184, 0, 0, 0, 0, 0,
1149	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1150	184, 0, 0, 0, 0, 184, 0, 0, 184, 0,
1151	0, 0, 0, 0, 0, 184, 184, 0, 0, 0,
1152	0, 0, 0, 0, 0, 0, 0, 0, 0, 193,
1153	0, 184, 184, 184, 0, 0, 203, 0, 0, 184,
1154	184, 184, 184, 184, 184, 184, 193, 0, 0, 193,
1155	0, 193, 193, 193, 193, 193, 193, 0, 0, 203,
1156	193, 193, 193, 193, 0, 193, 193, 0, 193, 193,
1157	0, 0, 193, 0, 0, 0, 193, 0, 193, 193,
1158	193, 193, 193, 0, 0, 193, 193, 193, 0, 0,
1159	0, 193, 0, 0, 0, 0, 0, 193, 0, 0,
1160	0, 0, 0, 0, 193, 0, 0, 0, 0, 0,
1161	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1162	193, 0, 0, 0, 0, 193, 0, 0, 193, 0,
1163	0, 0, 0, 0, 0, 193, 193, 0, 0, 0,
1164	0, 0, 0, 0, 0, 0, 0, 257, 0, 0,
1165	0, 193, 193, 193, 0, 0, 0, 0, 0, 193,
1166	193, 193, 193, 193, 193, 193, 193, 0, 0, 193,
1167	257, 0, 193, 193, 193, 193, 193, 0, 0, 0,
1168	193, 193, 193, 193, 0, 193, 193, 0, 193, 193,
1169	0, 0, 193, 0, 0, 0, 193, 0, 193, 193,
1170	193, 193, 193, 0, 0, 193, 193, 193, 0, 0,
1171	0, 193, 0, 0, 0, 0, 0, 193, 0, 0,
1172	0, 0, 0, 0, 193, 0, 0, 0, 0, 0,
1173	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1174	193, 0, 0, 0, 0, 193, 0, 0, 193, 0,
1175	0, 0, 0, 0, 0, 193, 193, 0, 0, 0,
1176	257, 0, 0, 0, 0, 0, 0, 200, 0, 0,
1177	0, 193, 193, 193, 0, 0, 0, 0, 0, 193,
1178	193, 193, 193, 193, 193, 193, 203, 0, 0, 203,
1179	200, 0, 203, 203, 203, 203, 203, 0, 0, 0,
1180	203, 203, 203, 203, 0, 203, 203, 0, 203, 203,
1181	0, 0, 203, 0, 0, 0, 203, 0, 203, 203,
1182	203, 203, 203, 0, 0, 203, 203, 203, 0, 0,
1183	0, 203, 0, 0, 0, 0, 0, 203, 0, 0,
1184	0, 0, 0, 0, 203, 0, 0, 0, 0, 0,
1185	0, 203, 0, 0, 0, 0, 0, 0, 0, 0,
1186	203, 0, 0, 0, 0, 203, 0, 0, 203, 0,
1187	0, 0, 0, 0, 0, 203, 203, 0, 0, 0,
1188	0, 0, 0, 0, 0, 0, 0, 199, 0, 0,
1189	0, 203, 203, 203, 0, 0, 0, 257, 0, 203,
1190	203, 203, 203, 203, 203, 203, 257, 257, 0, 0,
1191	199, 0, 0, 0, 0, 0, 257, 257, 0, 257,
1192	257, 0, 257, 257, 0, 0, 0, 257, 0, 257,
1193	257, 257, 257, 257, 0, 0, 257, 257, 257, 0,
1194	0, 0, 257, 0, 0, 0, 0, 0, 257, 0,
1195	0, 0, 0, 0, 0, 257, 0, 0, 0, 0,
1196	0, 0, 0, 0, 0, 257, 257, 257, 257, 257,
1197	257, 257, 0, 0, 0, 0, 257, 0, 0, 257,
1198	0, 0, 0, 0, 0, 0, 257, 257, 0, 0,
1199	257, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1200	0, 0, 257, 257, 257, 0, 0, 196, 0, 0,
1201	257, 257, 257, 257, 257, 257, 257, 200, 0, 0,
1202	200, 0, 0, 0, 200, 200, 200, 200, 0, 0,
1203	196, 200, 200, 200, 200, 0, 200, 200, 0, 200,
1204	200, 0, 0, 200, 0, 0, 0, 200, 0, 200,
1205	200, 200, 200, 200, 0, 0, 200, 200, 200, 0,
1206	0, 0, 200, 0, 0, 0, 0, 0, 200, 0,
1207	0, 0, 0, 0, 0, 200, 0, 0, 0, 0,
1208	0, 0, 200, 0, 0, 0, 0, 0, 0, 0,
1209	0, 200, 0, 0, 0, 0, 200, 0, 0, 200,
1210	0, 0, 0, 0, 0, 0, 200, 200, 0, 0,
1211	0, 0, 0, 0, 0, 0, 0, 0, 357, 0,
1212	196, 0, 200, 200, 200, 0, 0, 0, 0, 0,
1213	200, 200, 200, 200, 200, 200, 200, 199, 0, 0,
1214	199, 357, 0, 0, 199, 199, 199, 199, 0, 0,
1215	0, 199, 199, 199, 199, 0, 199, 199, 0, 199,
1216	199, 0, 0, 199, 0, 0, 0, 199, 0, 199,
1217	199, 199, 199, 199, 0, 0, 199, 199, 199, 0,
1218	0, 0, 199, 0, 0, 0, 0, 0, 199, 0,
1219	0, 0, 0, 0, 0, 199, 0, 0, 0, 0,
1220	0, 0, 199, 0, 0, 0, 0, 0, 0, 0,
1221	0, 199, 0, 0, 0, 0, 199, 0, 0, 199,
1222	0, 0, 0, 0, 0, 0, 199, 199, 0, 0,
1223	0, 357, 0, 0, 0, 0, 0, 0, 359, 0,
1224	0, 0, 199, 199, 199, 0, 0, 0, 0, 0,
1225	199, 199, 199, 199, 199, 199, 199, 196, 0, 0,
1226	196, 359, 0, 0, 196, 196, 196, 196, 0, 0,
1227	0, 196, 196, 196, 196, 0, 196, 196, 0, 196,
1228	196, 0, 0, 196, 0, 0, 0, 196, 0, 196,
1229	196, 196, 196, 196, 0, 0, 196, 196, 196, 0,
1230	0, 0, 196, 0, 0, 0, 0, 0, 196, 0,
1231	0, 0, 0, 0, 0, 196, 0, 0, 0, 0,
1232	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1233	0, 196, 0, 0, 0, 0, 196, 0, 0, 196,
1234	0, 0, 0, 0, 0, 0, 196, 196, 0, 0,
1235	0, 359, 0, 0, 0, 0, 0, 0, 363, 0,
1236	0, 0, 196, 196, 196, 0, 0, 0, 357, 0,
1237	196, 196, 196, 196, 196, 196, 196, 357, 357, 0,
1238	0, 363, 0, 0, 0, 0, 0, 357, 357, 0,
1239	357, 357, 0, 0, 357, 0, 0, 0, 357, 0,
1240	357, 357, 357, 357, 357, 0, 0, 357, 357, 357,
1241	0, 0, 0, 357, 0, 0, 0, 0, 0, 357,
1242	0, 0, 0, 0, 0, 0, 357, 0, 0, 0,
1243	0, 0, 0, 0, 0, 0, 357, 357, 357, 357,
1244	357, 357, 357, 0, 0, 0, 0, 357, 0, 0,
1245	357, 0, 0, 0, 0, 0, 0, 357, 357, 0,
1246	0, 357, 0, 0, 0, 0, 0, 0, 0, 0,
1247	0, 363, 0, 357, 357, 357, 0, 0, 198, 0,
1248	0, 357, 357, 357, 357, 357, 357, 357, 359, 0,
1249	0, 0, 0, 0, 0, 0, 0, 359, 359, 0,
1250	0, 198, 0, 0, 0, 0, 0, 359, 359, 0,
1251	359, 359, 0, 0, 359, 0, 0, 0, 359, 0,
1252	359, 359, 359, 359, 359, 0, 0, 359, 359, 359,
1253	0, 0, 0, 359, 0, 0, 0, 0, 0, 359,
1254	0, 0, 0, 0, 0, 0, 359, 0, 0, 0,
1255	0, 0, 0, 0, 0, 0, 359, 359, 359, 359,
1256	359, 359, 359, 0, 0, 0, 0, 359, 0, 0,
1257	359, 0, 0, 0, 0, 0, 0, 359, 359, 0,
1258	0, 359, 0, 0, 0, 0, 0, 0, 0, 0,
1259	0, 0, 0, 359, 359, 359, 0, 0, 211, 0,
1260	0, 359, 359, 359, 359, 359, 359, 359, 363, 0,
1261	0, 0, 0, 0, 0, 0, 0, 363, 363, 0,
1262	0, 211, 0, 0, 0, 0, 0, 363, 363, 0,
1263	363, 363, 0, 0, 363, 0, 0, 0, 363, 0,
1264	363, 363, 363, 363, 363, 0, 0, 363, 363, 363,
1265	0, 0, 0, 363, 0, 0, 0, 0, 0, 363,
1266	0, 0, 0, 0, 0, 0, 363, 0, 0, 0,
1267	0, 0, 0, 0, 0, 0, 361, 361, 361, 361,
1268	361, 361, 363, 0, 0, 0, 0, 363, 0, 0,
1269	363, 0, 0, 0, 0, 0, 0, 363, 363, 0,
1270	0, 361, 0, 0, 0, 0, 0, 0, 0, 363,
1271	0, 211, 0, 363, 363, 363, 0, 0, 0, 0,
1272	0, 363, 363, 363, 363, 363, 363, 363, 198, 0,
1273	0, 198, 363, 0, 0, 198, 198, 198, 198, 0,
1274	0, 0, 198, 198, 198, 198, 0, 198, 198, 0,
1275	198, 198, 0, 0, 198, 0, 0, 0, 198, 0,
1276	198, 198, 198, 198, 198, 0, 0, 198, 198, 198,
1277	0, 0, 0, 198, 0, 0, 0, 0, 0, 198,
1278	0, 0, 0, 0, 0, 0, 198, 0, 0, 0,
1279	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1280	0, 0, 198, 0, 0, 0, 0, 198, 0, 0,
1281	198, 0, 0, 0, 0, 0, 0, 198, 198, 0,
1282	0, 0, 363, 0, 0, 0, 0, 0, 0, 211,
1283	0, 0, 0, 198, 198, 198, 0, 0, 0, 0,
1284	0, 198, 198, 198, 198, 198, 198, 198, 211, 0,
1285	0, 211, 211, 0, 0, 0, 211, 211, 211, 0,
1286	0, 0, 211, 211, 211, 211, 0, 211, 211, 0,
1287	211, 211, 0, 0, 211, 0, 0, 0, 211, 0,
1288	211, 211, 211, 211, 211, 0, 0, 211, 211, 211,
1289	0, 0, 0, 211, 0, 0, 0, 0, 0, 211,
1290	0, 0, 0, 0, 0, 0, 211, 0, 0, 0,
1291	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1292	0, 0, 211, 0, 0, 0, 0, 211, 0, 0,
1293	211, 0, 0, 0, 0, 0, 0, 211, 211, 0,
1294	0, 0, 0, 0, 0, 0, 0, 0, 0, 220,
1295	0, 0, 0, 211, 211, 211, 0, 0, 0, 363,
1296	0, 211, 211, 211, 211, 211, 211, 211, 0, 363,
1297	0, 0, 220, 0, 0, 0, 0, 0, 363, 363,
1298	0, 363, 363, 0, 0, 363, 0, 0, 0, 363,
1299	0, 363, 363, 363, 363, 363, 0, 0, 363, 363,
1300	363, 0, 0, 0, 363, 0, 0, 0, 0, 0,
1301	363, 0, 0, 0, 0, 0, 0, 363, 0, 0,
1302	0, 0, 0, 0, 0, 0, 0, 361, 361, 361,
1303	361, 361, 361, 363, 0, 0, 0, 0, 363, 0,
1304	0, 363, 0, 0, 0, 0, 0, 0, 363, 363,
1305	0, 0, 361, 0, 0, 0, 0, 0, 0, 0,
1306	0, 0, 220, 0, 363, 363, 363, 0, 0, 220,
1307	0, 0, 363, 363, 363, 363, 363, 363, 363, 211,
1308	0, 0, 211, 0, 0, 0, 0, 211, 211, 211,
1309	0, 0, 220, 211, 211, 211, 211, 0, 211, 211,
1310	0, 211, 211, 0, 0, 211, 0, 0, 0, 211,
1311	0, 211, 211, 211, 211, 211, 0, 0, 211, 211,
1312	211, 0, 0, 0, 211, 0, 0, 0, 0, 0,
1313	211, 0, 0, 0, 0, 0, 0, 211, 0, 0,
1314	0, 42, 0, 43, 0, 44, 45, 46, 47, 48,
1315	0, 0, 49, 211, 50, 51, 52, 0, 211, 0,
1316	0, 211, 0, 0, 0, 0, 0, 0, 211, 211,
1317	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1318	0, 53, 0, 0, 211, 211, 211, 0, 0, 223,
1319	0, 0, 211, 211, 211, 211, 211, 211, 211, 220,
1320	0, 0, 220, 54, 55, 0, 0, 220, 220, 220,
1321	0, 0, 223, 220, 0, 0, 220, 0, 220, 220,
1322	0, 220, 220, 0, 0, 220, 0, 0, 0, 220,
1323	0, 220, 220, 220, 220, 220, 0, 0, 220, 220,
1324	220, 0, 0, 0, 220, 0, 0, 0, 0, 0,
1325	220, 0, 0, 0, 0, 0, 0, 220, 0, 0,
1326	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1327	0, 0, 0, 220, 0, 0, 0, 0, 220, 0,
1328	0, 220, 0, 0, 0, 0, 0, 0, 220, 220,
1329	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1330	0, 0, 223, 0, 220, 220, 220, 0, 0, 223,
1331	0, 0, 220, 220, 220, 220, 220, 220, 220, 220,
1332	0, 0, 220, 0, 0, 0, 0, 220, 220, 220,
1333	0, 0, 223, 220, 0, 0, 220, 0, 220, 220,
1334	0, 220, 220, 0, 0, 220, 0, 0, 0, 220,
1335	0, 220, 220, 220, 220, 220, 0, 0, 220, 220,
1336	220, 0, 0, 0, 220, 0, 0, 0, 0, 0,
1337	220, 0, 0, 0, 0, 0, 0, 220, 0, 0,
1338	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1339	0, 0, 0, 220, 0, 0, 0, 0, 220, 0,
1340	0, 220, 0, 0, 0, 0, 0, 0, 220, 220,
1341	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1342	0, 0, 0, 0, 220, 220, 220, 0, 0, 239,
1343	0, 0, 220, 220, 220, 220, 220, 220, 220, 223,
1344	0, 0, 223, 0, 0, 0, 0, 223, 223, 223,
1345	0, 0, 239, 0, 0, 0, 223, 0, 223, 223,
1346	0, 223, 223, 0, 0, 223, 0, 0, 0, 223,
1347	0, 223, 223, 223, 223, 223, 0, 0, 223, 223,
1348	223, 0, 0, 0, 223, 0, 0, 0, 0, 0,
1349	223, 0, 0, 0, 0, 0, 0, 223, 0, 0,
1350	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1351	0, 0, 0, 223, 0, 0, 0, 0, 223, 0,
1352	0, 223, 0, 0, 0, 0, 0, 0, 223, 223,
1353	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1354	0, 0, 239, 0, 223, 223, 223, 0, 0, 243,
1355	0, 0, 223, 223, 223, 223, 223, 223, 223, 223,
1356	0, 0, 223, 0, 0, 0, 0, 223, 223, 223,
1357	0, 0, 243, 0, 0, 0, 223, 0, 223, 223,
1358	0, 223, 223, 0, 0, 223, 0, 0, 0, 223,
1359	0, 223, 223, 223, 223, 223, 0, 0, 223, 223,
1360	223, 0, 0, 0, 223, 0, 0, 0, 0, 0,
1361	223, 0, 0, 0, 0, 0, 0, 223, 0, 0,
1362	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1363	0, 0, 0, 223, 0, 0, 0, 0, 223, 0,
1364	0, 223, 0, 0, 0, 0, 0, 0, 223, 223,
1365	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1366	0, 0, 243, 0, 223, 223, 223, 0, 0, 239,
1367	0, 0, 223, 223, 223, 223, 223, 223, 223, 239,
1368	0, 0, 239, 0, 0, 0, 0, 0, 239, 239,
1369	0, 0, 239, 0, 0, 0, 0, 0, 239, 239,
1370	0, 239, 239, 0, 0, 239, 0, 0, 0, 239,
1371	0, 239, 239, 239, 239, 239, 0, 0, 239, 239,
1372	239, 0, 0, 0, 239, 0, 0, 0, 0, 0,
1373	239, 0, 0, 0, 0, 0, 0, 239, 0, 0,
1374	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1375	0, 0, 0, 239, 0, 0, 0, 0, 239, 0,
1376	0, 239, 0, 0, 0, 0, 0, 0, 239, 239,
1377	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1378	233, 0, 0, 0, 239, 239, 239, 0, 0, 0,
1379	0, 0, 239, 239, 239, 239, 239, 239, 239, 243,
1380	0, 0, 243, 233, 0, 0, 0, 0, 243, 243,
1381	0, 0, 0, 0, 0, 0, 0, 0, 243, 243,
1382	0, 243, 243, 0, 0, 243, 0, 0, 0, 243,
1383	0, 243, 243, 243, 243, 243, 0, 0, 243, 243,
1384	243, 0, 0, 0, 243, 0, 0, 0, 0, 0,
1385	243, 0, 0, 0, 0, 0, 0, 243, 0, 0,
1386	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1387	0, 0, 0, 243, 0, 0, 0, 0, 243, 0,
1388	0, 243, 0, 0, 0, 0, 0, 0, 243, 243,
1389	0, 0, 0, 233, 0, 0, 0, 0, 0, 0,
1390	362, 0, 0, 0, 243, 243, 243, 0, 0, 0,
1391	0, 0, 243, 243, 243, 243, 243, 243, 243, 239,
1392	0, 0, 239, 362, 0, 0, 0, 0, 239, 239,
1393	0, 0, 0, 0, 0, 0, 0, 0, 239, 239,
1394	0, 239, 239, 0, 0, 239, 0, 0, 0, 239,
1395	0, 239, 239, 239, 239, 239, 0, 0, 239, 239,
1396	239, 0, 0, 0, 239, 0, 0, 0, 0, 0,
1397	239, 0, 0, 0, 0, 0, 0, 239, 0, 0,
1398	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1399	0, 0, 0, 239, 0, 0, 0, 0, 239, 0,
1400	0, 239, 0, 0, 0, 0, 0, 0, 239, 239,
1401	0, 0, 0, 362, 0, 0, 0, 0, 0, 0,
1402	130, 0, 0, 0, 239, 239, 239, 0, 0, 0,
1403	233, 0, 239, 239, 239, 239, 239, 239, 239, 233,
1404	233, 0, 0, 128, 0, 0, 0, 0, 0, 233,
1405	233, 0, 233, 233, 0, 0, 233, 0, 0, 0,
1406	233, 0, 233, 233, 233, 233, 233, 0, 0, 233,
1407	233, 233, 0, 0, 0, 233, 0, 0, 0, 0,
1408	0, 233, 0, 0, 0, 0, 0, 0, 233, 0,
1409	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1410	0, 0, 0, 0, 233, 0, 0, 0, 0, 233,
1411	0, 0, 233, 0, 0, 0, 0, 0, 0, 233,
1412	233, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1413	241, 0, 0, 130, 0, 233, 233, 233, 0, 0,
1414	0, 0, 0, 233, 233, 233, 233, 233, 233, 233,
1415	362, 0, 0, 241, 0, 0, 0, 0, 0, 362,
1416	362, 0, 0, 0, 0, 0, 0, 0, 0, 362,
1417	362, 0, 362, 362, 0, 0, 362, 0, 0, 0,
1418	362, 0, 362, 362, 362, 362, 362, 0, 0, 362,
1419	362, 362, 0, 0, 0, 362, 0, 0, 0, 0,
1420	0, 362, 0, 0, 0, 0, 0, 0, 362, 0,
1421	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1422	0, 0, 0, 0, 362, 0, 0, 0, 0, 362,
1423	0, 0, 362, 0, 0, 0, 0, 0, 0, 362,
1424	362, 0, 0, 241, 0, 0, 0, 0, 0, 0,
1425	333, 0, 0, 0, 0, 362, 362, 362, 0, 0,
1426	0, 0, 0, 362, 362, 362, 362, 362, 362, 362,
1427	128, 0, 0, 333, 0, 0, 0, 0, 0, 0,
1428	128, 0, 0, 0, 0, 0, 0, 0, 0, 128,
1429	128, 0, 128, 128, 0, 0, 128, 0, 0, 0,
1430	128, 0, 128, 128, 128, 128, 128, 0, 0, 128,
1431	128, 128, 0, 0, 0, 128, 0, 0, 0, 0,
1432	0, 128, 0, 0, 0, 0, 0, 0, 128, 0,
1433	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1434	0, 0, 0, 0, 128, 0, 0, 0, 0, 128,
1435	0, 153, 128, 0, 0, 0, 0, 0, 0, 128,
1436	128, 0, 0, 333, 0, 0, 0, 0, 0, 0,
1437	0, 0, 0, 0, 153, 128, 128, 128, 0, 0,
1438	241, 0, 0, 128, 128, 128, 128, 128, 128, 128,
1439	241, 0, 0, 0, 0, 0, 0, 0, 0, 241,
1440	241, 0, 241, 241, 0, 0, 241, 0, 0, 0,
1441	241, 0, 241, 241, 241, 241, 241, 0, 0, 241,
1442	241, 241, 0, 0, 0, 241, 0, 0, 0, 0,
1443	0, 241, 0, 0, 0, 0, 0, 0, 241, 0,
1444	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1445	0, 0, 130, 0, 241, 0, 0, 0, 0, 241,
1446	0, 0, 241, 0, 153, 0, 0, 0, 0, 241,
1447	241, 0, 0, 0, 0, 128, 0, 0, 0, 0,
1448	0, 0, 0, 0, 0, 241, 241, 241, 0, 0,
1449	0, 0, 0, 241, 241, 241, 241, 241, 241, 241,
1450	333, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1451	333, 0, 0, 0, 0, 0, 0, 0, 0, 333,
1452	333, 0, 333, 333, 0, 0, 333, 0, 0, 0,
1453	333, 0, 333, 333, 333, 333, 333, 0, 0, 333,
1454	333, 333, 0, 0, 0, 333, 0, 0, 0, 0,
1455	0, 333, 0, 0, 0, 0, 0, 0, 333, 0,
1456	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1457	0, 0, 0, 0, 333, 0, 162, 0, 0, 333,
1458	0, 0, 333, 0, 0, 0, 0, 0, 0, 333,
1459	333, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1460	0, 153, 0, 0, 0, 333, 333, 333, 0, 0,
1461	0, 153, 0, 333, 333, 333, 333, 333, 333, 333,
1462	153, 153, 0, 153, 153, 0, 0, 153, 0, 0,
1463	0, 153, 0, 153, 153, 153, 153, 153, 0, 0,
1464	153, 153, 153, 0, 0, 0, 153, 0, 0, 0,
1465	0, 0, 153, 0, 0, 0, 0, 0, 0, 153,
1466	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1467	0, 0, 0, 0, 0, 153, 0, 0, 0, 0,
1468	153, 0, 0, 153, 0, 0, 0, 0, 0, 0,
1469	153, 153, 0, 0, 0, 0, 0, 0, 0, 0,
1470	0, 0, 128, 0, 0, 0, 153, 153, 153, 0,
1471	0, 0, 128, 0, 153, 153, 153, 153, 153, 153,
1472	153, 128, 128, 0, 128, 128, 0, 0, 128, 0,
1473	0, 0, 128, 0, 128, 128, 128, 128, 128, 0,
1474	0, 128, 128, 128, 0, 0, 0, 128, 0, 0,
1475	0, 0, 0, 128, 0, 0, 0, 0, 0, 0,
1476	128, 0, 0, 0, 0, 0, 0, 0, 0, 0,
1477	0, 0, 0, 0, 0, 0, 128, 0, 0, 0,
1478	0, 128, 0, 0, 128, 0, 0, 0, 0, 0,
1479	0, 128, 128, 0, 0, 0, 0, 0, 0, 0,
1480	0, 0, 0, 373, 0, 0, 0, 128, 128, 128,
1481	0, 0, 0, 374, 0, 128, 128, 128, 128, 128,
1482	128, 128, 375, 376, 0, 377, 378, 0, 0, 379,
1483	0, 0, 0, 380, 0, 381, 382, 383, 384, 385,
1484	0, 0, 386, 387, 388, 0, 0, 0, 389, 0,
1485	0, 0, 0, 0, 390, 0, 0, 0, 0, 0,
1486	0, 391, 0, 0, 0, 0, 0, 0, 0, 0,
1487	0, 0, 0, 0, 0, 0, 0, 392, 0, 0,
1488	0, 0, 393, 0, 0, 394, 0, 0, 0, 0,
1489	0, 0, 395, 396, 0, 0, 0, 0, 0, 0,
1490	0, 0, 0, 0, 0, 0, 0, 0, 397, 0,
1491	398, 0, 0, 0, 0, 0, 399, 400, 401, 402,
1492	403, 404,
1493	};
1494	const short yycheck[] =
1495	{ 3,
1496	3, 95, 63, 110, 0, 10, 145, 40, 10, 40,
1497	33, 10, 47, 10, 10, 40, 10, 40, 33, 123,
1498	164, 44, 435, 371, 33, 40, 123, 33, 40, 44,
1499	123, 33, 323, 324, 44, 40, 511, 60, 40, 44,
1500	459, 123, 44, 182, 188, 60, 10, 123, 402, 33,
1501	404, 489, 277, 44, 44, 60, 10, 123, 60, 33,
1502	40, 105, 535, 157, 325, 33, 40, 161, 10, 123,
1503	209, 178, 211, 551, 387, 388, 44, 41, 212, 140,
1504	44, 278, 548, 311, 537, 444, 60, 296, 33, 196,
1505	33, 278, 40, 187, 33, 462, 44, 457, 123, 295,
1506	123, 123, 125, 158, 366, 244, 479, 33, 123, 160,
1507	125, 60, 60, 252, 208, 125, 210, 379, 257, 383,
1508	125, 123, 40, 125, 123, 44, 10, 472, 267, 123,
1509	366, 61, 492, 342, 125, 125, 265, 266, 505, 123,
1510	507, 40, 60, 33, 268, 239, 343, 40, 44, 123,
1511	40, 125, 286, 277, 629, 44, 343, 125, 383, 253,
1512	10, 60, 321, 44, 258, 638, 579, 60, 212, 44,
1513	60, 125, 433, 40, 313, 534, 654, 125, 123, 552,
1514	123, 600, 530, 621, 123, 651, 383, 383, 641, 283,
1515	284, 41, 40, 248, 44, 33, 383, 123, 291, 125,
1516	251, 437, 40, 44, 549, 123, 125, 44, 302, 261,
1517	383, 141, 60, 10, 568, 309, 355, 356, 357, 10,
1518	314, 151, 60, 198, 383, 319, 303, 321, 366, 125,
1519	205, 522, 523, 123, 328, 548, 125, 383, 551, 269,
1520	44, 379, 286, 278, 125, 44, 44, 277, 41, 40,
1521	125, 44, 671, 278, 306, 278, 381, 382, 383, 626,
1522	256, 257, 258, 259, 358, 61, 278, 344, 362, 278,
1523	300, 44, 278, 40, 297, 298, 10, 221, 417, 383,
1524	384, 309, 297, 298, 125, 123, 383, 384, 125, 333,
1525	383, 398, 291, 60, 278, 297, 298, 327, 278, 296,
1526	439, 383, 256, 257, 258, 259, 10, 383, 384, 10,
1527	278, 307, 10, 309, 542, 311, 40, 383, 343, 413,
1528	687, 125, 676, 297, 298, 10, 125, 125, 324, 383,
1529	326, 343, 426, 278, 343, 33, 44, 343, 651, 303,
1530	285, 654, 40, 339, 438, 342, 44, 291, 383, 372,
1531	383, 347, 125, 384, 448, 309, 320, 372, 383, 453,
1532	383, 384, 60, 343, 458, 509, 410, 372, 383, 384,
1533	372, 383, 366, 383, 383, 343, 470, 383, 383, 384,
1534	40, 383, 384, 477, 383, 379, 525, 383, 278, 10,
1535	354, 355, 356, 383, 384, 359, 360, 361, 372, 363,
1536	364, 508, 10, 383, 368, 369, 40, 297, 298, 383,
1537	384, 278, 296, 10, 44, 383, 44, 125, 646, 383,
1538	262, 560, 264, 562, 372, 123, 60, 125, 403, 10,
1539	524, 40, 526, 10, 573, 383, 384, 33, 10, 41,
1540	278, 10, 44, 504, 40, 45, 10, 47, 41, 277,
1541	589, 44, 591, 303, 372, 40, 595, 267, 342, 297,
1542	298, 33, 601, 10, 60, 383, 384, 10, 40, 10,
1543	320, 383, 44, 372, 613, 383, 343, 616, 572, 372,
1544	619, 10, 372, 544, 383, 384, 41, 581, 60, 44,
1545	383, 384, 10, 383, 384, 125, 383, 125, 592, 606,
1546	383, 384, 596, 564, 354, 355, 356, 383, 336, 359,
1547	360, 361, 41, 363, 364, 44, 383, 383, 368, 369,
1548	614, 349, 265, 617, 372, 33, 40, 123, 10, 305,
1549	297, 298, 40, 383, 372, 383, 384, 631, 325, 336,
1550	337, 338, 368, 369, 341, 383, 384, 344, 304, 346,
1551	644, 123, 60, 125, 351, 256, 257, 258, 259, 266,
1552	40, 62, 260, 339, 44, 263, 660, 41, 10, 266,
1553	44, 269, 270, 349, 668, 669, 352, 287, 672, 673,
1554	278, 279, 280, 41, 282, 283, 44, 285, 286, 683,
1555	10, 10, 290, 60, 292, 293, 294, 295, 296, 297,
1556	298, 299, 300, 301, 384, 372, 307, 305, 309, 10,
1557	311, 383, 384, 311, 384, 123, 383, 384, 383, 384,
1558	318, 383, 384, 324, 44, 326, 630, 630, 357, 358,
1559	328, 329, 330, 331, 332, 333, 334, 335, 339, 275,
1560	276, 339, 269, 41, 342, 125, 347, 383, 384, 261,
1561	277, 349, 350, 383, 384, 353, 60, 61, 62, 271,
1562	272, 273, 384, 297, 298, 383, 384, 365, 366, 367,
1563	383, 384, 384, 300, 372, 373, 374, 375, 376, 377,
1564	378, 379, 383, 125, 384, 383, 384, 44, 260, 383,
1565	384, 263, 383, 384, 306, 384, 305, 269, 270, 44,
1566	327, 297, 298, 383, 384, 384, 278, 279, 280, 384,
1567	282, 283, 268, 285, 286, 60, 61, 62, 290, 123,
1568	292, 293, 294, 295, 296, 297, 298, 299, 300, 301,
1569	339, 384, 10, 305, 383, 384, 383, 384, 372, 311,
1570	349, 383, 384, 352, 383, 384, 318, 382, 383, 383,
1571	384, 41, 305, 40, 383, 33, 328, 329, 330, 331,
1572	332, 333, 334, 335, 383, 384, 44, 339, 383, 383,
1573	342, 47, 41, 384, 303, 33, 372, 349, 350, 383,
1574	125, 353, 60, 61, 62, 303, 339, 383, 384, 297,
1575	298, 320, 384, 365, 366, 367, 349, 62, 278, 352,
1576	372, 373, 374, 375, 376, 377, 378, 379, 41, 384,
1577	384, 383, 384, 384, 274, 257, 258, 259, 336, 337,
1578	338, 303, 383, 341, 41, 354, 355, 356, 346, 383,
1579	359, 360, 361, 351, 363, 364, 362, 383, 320, 368,
1580	369, 287, 288, 383, 357, 123, 384, 125, 60, 61,
1581	62, 345, 263, 325, 383, 285, 302, 10, 335, 269,
1582	383, 47, 308, 343, 372, 47, 383, 309, 383, 123,
1583	40, 317, 354, 355, 356, 383, 384, 359, 360, 361,
1584	33, 363, 364, 303, 326, 384, 368, 369, 383, 287,
1585	288, 44, 385, 284, 284, 60, 61, 62, 284, 284,
1586	384, 383, 303, 383, 302, 384, 384, 60, 61, 62,
1587	308, 123, 383, 285, 384, 383, 336, 337, 338, 317,
1588	384, 341, 41, 62, 344, 384, 346, 60, 61, 62,
1589	344, 351, 303, 383, 47, 336, 337, 338, 281, 281,
1590	341, 40, 385, 344, 285, 346, 385, 384, 383, 47,
1591	351, 285, 268, 10, 383, 41, 384, 384, 123, 328,
1592	329, 330, 331, 332, 333, 41, 384, 384, 383, 269,
1593	123, 383, 125, 10, 325, 384, 380, 381, 382, 383,
1594	384, 10, 260, 10, 353, 263, 41, 10, 268, 10,
1595	383, 269, 270, 60, 61, 62, 10, 10, 10, 383,
1596	10, 279, 280, 10, 282, 283, 10, 268, 286, 60,
1597	61, 62, 290, 41, 292, 293, 294, 295, 296, 33,
1598	384, 299, 300, 301, 60, 61, 62, 305, 485, 54,
1599	44, 564, 242, 311, 201, 380, 381, 382, 383, 384,
1600	318, 279, 415, 336, 349, 372, 60, 61, 62, 385,
1601	336, 337, 338, 62, 539, 341, 334, 140, 66, 177,
1602	346, 339, 57, 219, 342, 351, 297, 315, 336, 337,
1603	338, 349, 350, 341, 263, 410, 636, 232, 346, 486,
1604	241, 612, 630, 351, 282, -1, -1, 365, 366, 367,
1605	-1, -1, -1, -1, -1, 373, 374, 375, 376, 377,
1606	378, 379, 380, 381, 382, 383, 384, 260, -1, 123,
1607	-1, 125, 60, 61, 62, -1, -1, 270, -1, -1,
1608	-1, 10, -1, -1, -1, -1, 279, 280, -1, 282,
1609	283, -1, -1, 286, -1, -1, -1, 290, -1, 292,
1610	293, 294, 295, 296, 33, -1, 299, 300, 301, -1,
1611	-1, -1, 305, -1, -1, 44, -1, -1, 311, -1,
1612	-1, -1, -1, -1, -1, 318, -1, -1, 380, 381,
1613	382, 383, 384, -1, -1, -1, -1, -1, -1, -1,
1614	-1, 334, -1, -1, -1, -1, 339, -1, -1, 342,
1615	-1, -1, -1, -1, -1, -1, 349, 350, -1, -1,
1616	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1617	-1, -1, 365, 366, 367, 380, 381, 382, 383, 384,
1618	373, 374, 375, 376, 377, 378, 379, 380, 381, 382,
1619	383, 384, -1, -1, 123, -1, 125, -1, -1, -1,
1620	-1, 10, -1, -1, -1, -1, 260, 380, 381, 382,
1621	383, 384, -1, -1, -1, -1, 270, -1, -1, -1,
1622	-1, -1, -1, -1, 33, 279, 280, -1, 282, 283,
1623	-1, -1, 286, -1, -1, 44, 290, -1, 292, 293,
1624	294, 295, 296, 33, -1, 299, 300, 301, -1, -1,
1625	40, 305, -1, -1, 44, -1, -1, 311, -1, -1,
1626	-1, -1, -1, -1, 318, -1, -1, -1, -1, -1,
1627	60, 61, 62, 380, 381, 382, 383, 384, -1, -1,
1628	334, -1, -1, -1, -1, 339, -1, -1, 342, 380,
1629	381, 382, 383, 384, -1, 349, 350, -1, -1, -1,
1630	-1, -1, -1, -1, 380, 381, 382, 383, 384, -1,
1631	-1, 365, 366, 367, 123, -1, 125, -1, -1, 373,
1632	374, 375, 376, 377, 378, 379, 380, 381, 382, 383,
1633	384, 260, -1, 123, -1, 125, -1, -1, -1, -1,
1634	-1, 270, -1, -1, -1, -1, 10, -1, -1, -1,
1635	279, 280, -1, 282, 283, -1, -1, 286, -1, -1,
1636	-1, 290, -1, 292, 293, 294, 295, 296, -1, 33,
1637	299, 300, 301, -1, -1, -1, 305, 41, -1, -1,
1638	44, -1, 311, -1, -1, -1, -1, -1, -1, 318,
1639	-1, -1, 380, 381, 382, 383, 384, -1, -1, -1,
1640	-1, -1, -1, -1, -1, 334, -1, -1, -1, -1,
1641	339, -1, -1, 342, -1, -1, -1, -1, -1, -1,
1642	349, 350, -1, -1, -1, -1, -1, -1, -1, -1,
1643	-1, -1, -1, -1, -1, -1, 365, 366, 367, -1,
1644	-1, -1, -1, -1, 373, 374, 375, 376, 377, 378,
1645	379, 260, -1, -1, 383, 384, -1, -1, -1, 123,
1646	-1, 270, 303, -1, -1, -1, 10, -1, -1, -1,
1647	279, 280, -1, 282, 283, -1, -1, 286, -1, 320,
1648	-1, 290, -1, 292, 293, 294, 295, 296, 278, 33,
1649	299, 300, 301, -1, -1, -1, 305, -1, -1, -1,
1650	-1, -1, 311, -1, -1, -1, -1, 297, 298, 318,
1651	-1, -1, -1, 354, 355, 356, -1, -1, 359, 360,
1652	361, -1, 363, 364, -1, 334, -1, 368, 369, -1,
1653	339, -1, -1, 342, -1, -1, -1, -1, -1, -1,
1654	349, 350, 383, -1, -1, -1, -1, -1, -1, -1,
1655	-1, -1, -1, 343, -1, -1, 365, 366, 367, -1,
1656	-1, -1, -1, -1, 373, 374, 375, 376, 377, 378,
1657	379, -1, -1, -1, 383, 384, -1, -1, -1, -1,
1658	-1, -1, 372, -1, -1, -1, 10, -1, -1, -1,
1659	380, 381, 382, 383, 384, -1, 260, -1, -1, -1,
1660	-1, -1, -1, -1, -1, 269, 270, -1, -1, 33,
1661	-1, -1, -1, 277, -1, 279, 280, -1, 282, 283,
1662	-1, -1, 286, -1, -1, -1, 290, -1, 292, 293,
1663	294, 295, 296, -1, -1, 299, 300, 301, -1, -1,
1664	-1, 305, -1, -1, -1, -1, -1, 311, -1, -1,
1665	-1, -1, -1, -1, 318, -1, -1, -1, -1, -1,
1666	-1, -1, -1, 327, 328, 329, 330, 331, 332, 333,
1667	334, -1, -1, -1, -1, 339, -1, -1, 342, -1,
1668	-1, -1, -1, -1, -1, 349, 350, -1, -1, 353,
1669	-1, -1, -1, -1, -1, -1, -1, -1, -1, 123,
1670	-1, 365, 366, 367, -1, -1, 10, -1, -1, 373,
1671	374, 375, 376, 377, 378, 379, 260, -1, 262, 263,
1672	264, 265, 266, 267, 268, 269, 270, 303, -1, 33,
1673	274, 275, 276, 277, -1, 279, 280, -1, 282, 283,
1674	-1, -1, 286, -1, 320, -1, 290, -1, 292, 293,
1675	294, 295, 296, -1, -1, 299, 300, 301, -1, -1,
1676	-1, 305, -1, -1, -1, -1, -1, 311, -1, -1,
1677	-1, -1, -1, -1, 318, -1, -1, -1, 354, 355,
1678	356, -1, -1, 359, 360, 361, -1, 363, 364, -1,
1679	334, -1, 368, 369, -1, 339, -1, -1, 342, -1,
1680	-1, -1, -1, -1, -1, 349, 350, 383, -1, -1,
1681	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1682	-1, 365, 366, 367, -1, -1, 10, -1, -1, 373,
1683	374, 375, 376, 377, 378, 379, 260, -1, 262, 263,
1684	264, -1, 266, 267, 268, 269, 270, -1, -1, 33,
1685	274, 275, 276, 277, -1, 279, 280, -1, 282, 283,
1686	-1, -1, 286, -1, -1, -1, 290, -1, 292, 293,
1687	294, 295, 296, -1, -1, 299, 300, 301, -1, -1,
1688	-1, 305, -1, -1, -1, -1, -1, 311, -1, -1,
1689	-1, -1, -1, -1, 318, -1, -1, -1, -1, -1,
1690	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1691	334, -1, -1, -1, -1, 339, -1, -1, 342, -1,
1692	-1, -1, -1, -1, -1, 349, 350, -1, -1, -1,
1693	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1694	-1, 365, 366, 367, -1, -1, 10, -1, -1, 373,
1695	374, 375, 376, 377, 378, 379, 260, -1, 262, 263,
1696	264, 265, 266, 267, 268, 269, 270, -1, -1, 33,
1697	274, 275, 276, 277, -1, 279, 280, -1, 282, 283,
1698	-1, -1, 286, -1, -1, -1, 290, -1, 292, 293,
1699	294, 295, 296, -1, -1, 299, 300, 301, -1, -1,
1700	-1, 305, -1, -1, -1, -1, -1, 311, -1, -1,
1701	-1, -1, -1, -1, 318, -1, -1, -1, -1, -1,
1702	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1703	334, -1, -1, -1, -1, 339, -1, -1, 342, -1,
1704	-1, -1, -1, -1, -1, 349, 350, -1, -1, -1,
1705	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1706	-1, 365, 366, 367, -1, -1, 10, -1, -1, 373,
1707	374, 375, 376, 377, 378, 379, 260, -1, 262, 263,
1708	264, 265, 266, 267, 268, 269, 270, -1, -1, 33,
1709	274, 275, 276, 277, -1, 279, 280, -1, 282, 283,
1710	-1, -1, 286, -1, -1, -1, 290, -1, 292, 293,
1711	294, 295, 296, -1, -1, 299, 300, 301, -1, -1,
1712	-1, 305, -1, -1, -1, -1, -1, 311, -1, -1,
1713	-1, -1, -1, -1, 318, -1, -1, -1, -1, -1,
1714	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1715	334, -1, -1, -1, -1, 339, -1, -1, 342, -1,
1716	-1, -1, -1, -1, -1, 349, 350, -1, -1, -1,
1717	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1718	-1, 365, 366, 367, -1, -1, 10, -1, -1, 373,
1719	374, 375, 376, 377, 378, 379, 260, -1, 262, 263,
1720	264, 265, 266, 267, 268, 269, 270, -1, -1, 33,
1721	274, 275, 276, 277, -1, 279, 280, -1, 282, 283,
1722	-1, -1, 286, -1, -1, -1, 290, -1, 292, 293,
1723	294, 295, 296, -1, -1, 299, 300, 301, -1, -1,
1724	-1, 305, -1, -1, -1, -1, -1, 311, -1, -1,
1725	-1, -1, -1, -1, 318, -1, -1, -1, -1, -1,
1726	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1727	334, -1, -1, -1, -1, 339, -1, -1, 342, -1,
1728	-1, -1, -1, -1, -1, 349, 350, -1, -1, -1,
1729	-1, -1, -1, -1, -1, -1, -1, -1, -1, 123,
1730	-1, 365, 366, 367, -1, -1, 10, -1, -1, 373,
1731	374, 375, 376, 377, 378, 379, 260, -1, -1, 263,
1732	-1, 265, 266, 267, 268, 269, 270, -1, -1, 33,
1733	274, 275, 276, 277, -1, 279, 280, -1, 282, 283,
1734	-1, -1, 286, -1, -1, -1, 290, -1, 292, 293,
1735	294, 295, 296, -1, -1, 299, 300, 301, -1, -1,
1736	-1, 305, -1, -1, -1, -1, -1, 311, -1, -1,
1737	-1, -1, -1, -1, 318, -1, -1, -1, -1, -1,
1738	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1739	334, -1, -1, -1, -1, 339, -1, -1, 342, -1,
1740	-1, -1, -1, -1, -1, 349, 350, -1, -1, -1,
1741	-1, -1, -1, -1, -1, -1, -1, 10, -1, -1,
1742	-1, 365, 366, 367, -1, -1, -1, -1, -1, 373,
1743	374, 375, 376, 377, 378, 379, 260, -1, -1, 263,
1744	33, -1, 266, 267, 268, 269, 270, -1, -1, -1,
1745	274, 275, 276, 277, -1, 279, 280, -1, 282, 283,
1746	-1, -1, 286, -1, -1, -1, 290, -1, 292, 293,
1747	294, 295, 296, -1, -1, 299, 300, 301, -1, -1,
1748	-1, 305, -1, -1, -1, -1, -1, 311, -1, -1,
1749	-1, -1, -1, -1, 318, -1, -1, -1, -1, -1,
1750	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1751	334, -1, -1, -1, -1, 339, -1, -1, 342, -1,
1752	-1, -1, -1, -1, -1, 349, 350, -1, -1, -1,
1753	123, -1, -1, -1, -1, -1, -1, 10, -1, -1,
1754	-1, 365, 366, 367, -1, -1, -1, -1, -1, 373,
1755	374, 375, 376, 377, 378, 379, 260, -1, -1, 263,
1756	33, -1, 266, 267, 268, 269, 270, -1, -1, -1,
1757	274, 275, 276, 277, -1, 279, 280, -1, 282, 283,
1758	-1, -1, 286, -1, -1, -1, 290, -1, 292, 293,
1759	294, 295, 296, -1, -1, 299, 300, 301, -1, -1,
1760	-1, 305, -1, -1, -1, -1, -1, 311, -1, -1,
1761	-1, -1, -1, -1, 318, -1, -1, -1, -1, -1,
1762	-1, 325, -1, -1, -1, -1, -1, -1, -1, -1,
1763	334, -1, -1, -1, -1, 339, -1, -1, 342, -1,
1764	-1, -1, -1, -1, -1, 349, 350, -1, -1, -1,
1765	-1, -1, -1, -1, -1, -1, -1, 10, -1, -1,
1766	-1, 365, 366, 367, -1, -1, -1, 260, -1, 373,
1767	374, 375, 376, 377, 378, 379, 269, 270, -1, -1,
1768	33, -1, -1, -1, -1, -1, 279, 280, -1, 282,
1769	283, -1, 285, 286, -1, -1, -1, 290, -1, 292,
1770	293, 294, 295, 296, -1, -1, 299, 300, 301, -1,
1771	-1, -1, 305, -1, -1, -1, -1, -1, 311, -1,
1772	-1, -1, -1, -1, -1, 318, -1, -1, -1, -1,
1773	-1, -1, -1, -1, -1, 328, 329, 330, 331, 332,
1774	333, 334, -1, -1, -1, -1, 339, -1, -1, 342,
1775	-1, -1, -1, -1, -1, -1, 349, 350, -1, -1,
1776	353, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1777	-1, -1, 365, 366, 367, -1, -1, 10, -1, -1,
1778	373, 374, 375, 376, 377, 378, 379, 260, -1, -1,
1779	263, -1, -1, -1, 267, 268, 269, 270, -1, -1,
1780	33, 274, 275, 276, 277, -1, 279, 280, -1, 282,
1781	283, -1, -1, 286, -1, -1, -1, 290, -1, 292,
1782	293, 294, 295, 296, -1, -1, 299, 300, 301, -1,
1783	-1, -1, 305, -1, -1, -1, -1, -1, 311, -1,
1784	-1, -1, -1, -1, -1, 318, -1, -1, -1, -1,
1785	-1, -1, 325, -1, -1, -1, -1, -1, -1, -1,
1786	-1, 334, -1, -1, -1, -1, 339, -1, -1, 342,
1787	-1, -1, -1, -1, -1, -1, 349, 350, -1, -1,
1788	-1, -1, -1, -1, -1, -1, -1, -1, 10, -1,
1789	123, -1, 365, 366, 367, -1, -1, -1, -1, -1,
1790	373, 374, 375, 376, 377, 378, 379, 260, -1, -1,
1791	263, 33, -1, -1, 267, 268, 269, 270, -1, -1,
1792	-1, 274, 275, 276, 277, -1, 279, 280, -1, 282,
1793	283, -1, -1, 286, -1, -1, -1, 290, -1, 292,
1794	293, 294, 295, 296, -1, -1, 299, 300, 301, -1,
1795	-1, -1, 305, -1, -1, -1, -1, -1, 311, -1,
1796	-1, -1, -1, -1, -1, 318, -1, -1, -1, -1,
1797	-1, -1, 325, -1, -1, -1, -1, -1, -1, -1,
1798	-1, 334, -1, -1, -1, -1, 339, -1, -1, 342,
1799	-1, -1, -1, -1, -1, -1, 349, 350, -1, -1,
1800	-1, 123, -1, -1, -1, -1, -1, -1, 10, -1,
1801	-1, -1, 365, 366, 367, -1, -1, -1, -1, -1,
1802	373, 374, 375, 376, 377, 378, 379, 260, -1, -1,
1803	263, 33, -1, -1, 267, 268, 269, 270, -1, -1,
1804	-1, 274, 275, 276, 277, -1, 279, 280, -1, 282,
1805	283, -1, -1, 286, -1, -1, -1, 290, -1, 292,
1806	293, 294, 295, 296, -1, -1, 299, 300, 301, -1,
1807	-1, -1, 305, -1, -1, -1, -1, -1, 311, -1,
1808	-1, -1, -1, -1, -1, 318, -1, -1, -1, -1,
1809	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1810	-1, 334, -1, -1, -1, -1, 339, -1, -1, 342,
1811	-1, -1, -1, -1, -1, -1, 349, 350, -1, -1,
1812	-1, 123, -1, -1, -1, -1, -1, -1, 10, -1,
1813	-1, -1, 365, 366, 367, -1, -1, -1, 260, -1,
1814	373, 374, 375, 376, 377, 378, 379, 269, 270, -1,
1815	-1, 33, -1, -1, -1, -1, -1, 279, 280, -1,
1816	282, 283, -1, -1, 286, -1, -1, -1, 290, -1,
1817	292, 293, 294, 295, 296, -1, -1, 299, 300, 301,
1818	-1, -1, -1, 305, -1, -1, -1, -1, -1, 311,
1819	-1, -1, -1, -1, -1, -1, 318, -1, -1, -1,
1820	-1, -1, -1, -1, -1, -1, 328, 329, 330, 331,
1821	332, 333, 334, -1, -1, -1, -1, 339, -1, -1,
1822	342, -1, -1, -1, -1, -1, -1, 349, 350, -1,
1823	-1, 353, -1, -1, -1, -1, -1, -1, -1, -1,
1824	-1, 123, -1, 365, 366, 367, -1, -1, 10, -1,
1825	-1, 373, 374, 375, 376, 377, 378, 379, 260, -1,
1826	-1, -1, -1, -1, -1, -1, -1, 269, 270, -1,
1827	-1, 33, -1, -1, -1, -1, -1, 279, 280, -1,
1828	282, 283, -1, -1, 286, -1, -1, -1, 290, -1,
1829	292, 293, 294, 295, 296, -1, -1, 299, 300, 301,
1830	-1, -1, -1, 305, -1, -1, -1, -1, -1, 311,
1831	-1, -1, -1, -1, -1, -1, 318, -1, -1, -1,
1832	-1, -1, -1, -1, -1, -1, 328, 329, 330, 331,
1833	332, 333, 334, -1, -1, -1, -1, 339, -1, -1,
1834	342, -1, -1, -1, -1, -1, -1, 349, 350, -1,
1835	-1, 353, -1, -1, -1, -1, -1, -1, -1, -1,
1836	-1, -1, -1, 365, 366, 367, -1, -1, 10, -1,
1837	-1, 373, 374, 375, 376, 377, 378, 379, 260, -1,
1838	-1, -1, -1, -1, -1, -1, -1, 269, 270, -1,
1839	-1, 33, -1, -1, -1, -1, -1, 279, 280, -1,
1840	282, 283, -1, -1, 286, -1, -1, -1, 290, -1,
1841	292, 293, 294, 295, 296, -1, -1, 299, 300, 301,
1842	-1, -1, -1, 305, -1, -1, -1, -1, -1, 311,
1843	-1, -1, -1, -1, -1, -1, 318, -1, -1, -1,
1844	-1, -1, -1, -1, -1, -1, 328, 329, 330, 331,
1845	332, 333, 334, -1, -1, -1, -1, 339, -1, -1,
1846	342, -1, -1, -1, -1, -1, -1, 349, 350, -1,
1847	-1, 353, -1, -1, -1, -1, -1, -1, -1, 10,
1848	-1, 123, -1, 365, 366, 367, -1, -1, -1, -1,
1849	-1, 373, 374, 375, 376, 377, 378, 379, 260, -1,
1850	-1, 263, 33, -1, -1, 267, 268, 269, 270, -1,
1851	-1, -1, 274, 275, 276, 277, -1, 279, 280, -1,
1852	282, 283, -1, -1, 286, -1, -1, -1, 290, -1,
1853	292, 293, 294, 295, 296, -1, -1, 299, 300, 301,
1854	-1, -1, -1, 305, -1, -1, -1, -1, -1, 311,
1855	-1, -1, -1, -1, -1, -1, 318, -1, -1, -1,
1856	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1857	-1, -1, 334, -1, -1, -1, -1, 339, -1, -1,
1858	342, -1, -1, -1, -1, -1, -1, 349, 350, -1,
1859	-1, -1, 123, -1, -1, -1, -1, -1, -1, 10,
1860	-1, -1, -1, 365, 366, 367, -1, -1, -1, -1,
1861	-1, 373, 374, 375, 376, 377, 378, 379, 260, -1,
1862	-1, 263, 33, -1, -1, -1, 268, 269, 270, -1,
1863	-1, -1, 274, 275, 276, 277, -1, 279, 280, -1,
1864	282, 283, -1, -1, 286, -1, -1, -1, 290, -1,
1865	292, 293, 294, 295, 296, -1, -1, 299, 300, 301,
1866	-1, -1, -1, 305, -1, -1, -1, -1, -1, 311,
1867	-1, -1, -1, -1, -1, -1, 318, -1, -1, -1,
1868	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1869	-1, -1, 334, -1, -1, -1, -1, 339, -1, -1,
1870	342, -1, -1, -1, -1, -1, -1, 349, 350, -1,
1871	-1, -1, -1, -1, -1, -1, -1, -1, -1, 10,
1872	-1, -1, -1, 365, 366, 367, -1, -1, -1, 260,
1873	-1, 373, 374, 375, 376, 377, 378, 379, -1, 270,
1874	-1, -1, 33, -1, -1, -1, -1, -1, 279, 280,
1875	-1, 282, 283, -1, -1, 286, -1, -1, -1, 290,
1876	-1, 292, 293, 294, 295, 296, -1, -1, 299, 300,
1877	301, -1, -1, -1, 305, -1, -1, -1, -1, -1,
1878	311, -1, -1, -1, -1, -1, -1, 318, -1, -1,
1879	-1, -1, -1, -1, -1, -1, -1, 328, 329, 330,
1880	331, 332, 333, 334, -1, -1, -1, -1, 339, -1,
1881	-1, 342, -1, -1, -1, -1, -1, -1, 349, 350,
1882	-1, -1, 353, -1, -1, -1, -1, -1, -1, -1,
1883	-1, -1, 123, -1, 365, 366, 367, -1, -1, 10,
1884	-1, -1, 373, 374, 375, 376, 377, 378, 379, 260,
1885	-1, -1, 263, -1, -1, -1, -1, 268, 269, 270,
1886	-1, -1, 33, 274, 275, 276, 277, -1, 279, 280,
1887	-1, 282, 283, -1, -1, 286, -1, -1, -1, 290,
1888	-1, 292, 293, 294, 295, 296, -1, -1, 299, 300,
1889	301, -1, -1, -1, 305, -1, -1, -1, -1, -1,
1890	311, -1, -1, -1, -1, -1, -1, 318, -1, -1,
1891	-1, 308, -1, 310, -1, 312, 313, 314, 315, 316,
1892	-1, -1, 319, 334, 321, 322, 323, -1, 339, -1,
1893	-1, 342, -1, -1, -1, -1, -1, -1, 349, 350,
1894	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1895	-1, 348, -1, -1, 365, 366, 367, -1, -1, 10,
1896	-1, -1, 373, 374, 375, 376, 377, 378, 379, 260,
1897	-1, -1, 263, 370, 371, -1, -1, 268, 269, 270,
1898	-1, -1, 33, 274, -1, -1, 277, -1, 279, 280,
1899	-1, 282, 283, -1, -1, 286, -1, -1, -1, 290,
1900	-1, 292, 293, 294, 295, 296, -1, -1, 299, 300,
1901	301, -1, -1, -1, 305, -1, -1, -1, -1, -1,
1902	311, -1, -1, -1, -1, -1, -1, 318, -1, -1,
1903	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1904	-1, -1, -1, 334, -1, -1, -1, -1, 339, -1,
1905	-1, 342, -1, -1, -1, -1, -1, -1, 349, 350,
1906	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1907	-1, -1, 123, -1, 365, 366, 367, -1, -1, 10,
1908	-1, -1, 373, 374, 375, 376, 377, 378, 379, 260,
1909	-1, -1, 263, -1, -1, -1, -1, 268, 269, 270,
1910	-1, -1, 33, 274, -1, -1, 277, -1, 279, 280,
1911	-1, 282, 283, -1, -1, 286, -1, -1, -1, 290,
1912	-1, 292, 293, 294, 295, 296, -1, -1, 299, 300,
1913	301, -1, -1, -1, 305, -1, -1, -1, -1, -1,
1914	311, -1, -1, -1, -1, -1, -1, 318, -1, -1,
1915	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1916	-1, -1, -1, 334, -1, -1, -1, -1, 339, -1,
1917	-1, 342, -1, -1, -1, -1, -1, -1, 349, 350,
1918	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1919	-1, -1, -1, -1, 365, 366, 367, -1, -1, 10,
1920	-1, -1, 373, 374, 375, 376, 377, 378, 379, 260,
1921	-1, -1, 263, -1, -1, -1, -1, 268, 269, 270,
1922	-1, -1, 33, -1, -1, -1, 277, -1, 279, 280,
1923	-1, 282, 283, -1, -1, 286, -1, -1, -1, 290,
1924	-1, 292, 293, 294, 295, 296, -1, -1, 299, 300,
1925	301, -1, -1, -1, 305, -1, -1, -1, -1, -1,
1926	311, -1, -1, -1, -1, -1, -1, 318, -1, -1,
1927	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1928	-1, -1, -1, 334, -1, -1, -1, -1, 339, -1,
1929	-1, 342, -1, -1, -1, -1, -1, -1, 349, 350,
1930	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1931	-1, -1, 123, -1, 365, 366, 367, -1, -1, 10,
1932	-1, -1, 373, 374, 375, 376, 377, 378, 379, 260,
1933	-1, -1, 263, -1, -1, -1, -1, 268, 269, 270,
1934	-1, -1, 33, -1, -1, -1, 277, -1, 279, 280,
1935	-1, 282, 283, -1, -1, 286, -1, -1, -1, 290,
1936	-1, 292, 293, 294, 295, 296, -1, -1, 299, 300,
1937	301, -1, -1, -1, 305, -1, -1, -1, -1, -1,
1938	311, -1, -1, -1, -1, -1, -1, 318, -1, -1,
1939	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1940	-1, -1, -1, 334, -1, -1, -1, -1, 339, -1,
1941	-1, 342, -1, -1, -1, -1, -1, -1, 349, 350,
1942	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1943	-1, -1, 123, -1, 365, 366, 367, -1, -1, 10,
1944	-1, -1, 373, 374, 375, 376, 377, 378, 379, 260,
1945	-1, -1, 263, -1, -1, -1, -1, -1, 269, 270,
1946	-1, -1, 33, -1, -1, -1, -1, -1, 279, 280,
1947	-1, 282, 283, -1, -1, 286, -1, -1, -1, 290,
1948	-1, 292, 293, 294, 295, 296, -1, -1, 299, 300,
1949	301, -1, -1, -1, 305, -1, -1, -1, -1, -1,
1950	311, -1, -1, -1, -1, -1, -1, 318, -1, -1,
1951	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1952	-1, -1, -1, 334, -1, -1, -1, -1, 339, -1,
1953	-1, 342, -1, -1, -1, -1, -1, -1, 349, 350,
1954	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1955	10, -1, -1, -1, 365, 366, 367, -1, -1, -1,
1956	-1, -1, 373, 374, 375, 376, 377, 378, 379, 260,
1957	-1, -1, 263, 33, -1, -1, -1, -1, 269, 270,
1958	-1, -1, -1, -1, -1, -1, -1, -1, 279, 280,
1959	-1, 282, 283, -1, -1, 286, -1, -1, -1, 290,
1960	-1, 292, 293, 294, 295, 296, -1, -1, 299, 300,
1961	301, -1, -1, -1, 305, -1, -1, -1, -1, -1,
1962	311, -1, -1, -1, -1, -1, -1, 318, -1, -1,
1963	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1964	-1, -1, -1, 334, -1, -1, -1, -1, 339, -1,
1965	-1, 342, -1, -1, -1, -1, -1, -1, 349, 350,
1966	-1, -1, -1, 123, -1, -1, -1, -1, -1, -1,
1967	10, -1, -1, -1, 365, 366, 367, -1, -1, -1,
1968	-1, -1, 373, 374, 375, 376, 377, 378, 379, 260,
1969	-1, -1, 263, 33, -1, -1, -1, -1, 269, 270,
1970	-1, -1, -1, -1, -1, -1, -1, -1, 279, 280,
1971	-1, 282, 283, -1, -1, 286, -1, -1, -1, 290,
1972	-1, 292, 293, 294, 295, 296, -1, -1, 299, 300,
1973	301, -1, -1, -1, 305, -1, -1, -1, -1, -1,
1974	311, -1, -1, -1, -1, -1, -1, 318, -1, -1,
1975	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1976	-1, -1, -1, 334, -1, -1, -1, -1, 339, -1,
1977	-1, 342, -1, -1, -1, -1, -1, -1, 349, 350,
1978	-1, -1, -1, 123, -1, -1, -1, -1, -1, -1,
1979	10, -1, -1, -1, 365, 366, 367, -1, -1, -1,
1980	260, -1, 373, 374, 375, 376, 377, 378, 379, 269,
1981	270, -1, -1, 33, -1, -1, -1, -1, -1, 279,
1982	280, -1, 282, 283, -1, -1, 286, -1, -1, -1,
1983	290, -1, 292, 293, 294, 295, 296, -1, -1, 299,
1984	300, 301, -1, -1, -1, 305, -1, -1, -1, -1,
1985	-1, 311, -1, -1, -1, -1, -1, -1, 318, -1,
1986	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1987	-1, -1, -1, -1, 334, -1, -1, -1, -1, 339,
1988	-1, -1, 342, -1, -1, -1, -1, -1, -1, 349,
1989	350, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1990	10, -1, -1, 123, -1, 365, 366, 367, -1, -1,
1991	-1, -1, -1, 373, 374, 375, 376, 377, 378, 379,
1992	260, -1, -1, 33, -1, -1, -1, -1, -1, 269,
1993	270, -1, -1, -1, -1, -1, -1, -1, -1, 279,
1994	280, -1, 282, 283, -1, -1, 286, -1, -1, -1,
1995	290, -1, 292, 293, 294, 295, 296, -1, -1, 299,
1996	300, 301, -1, -1, -1, 305, -1, -1, -1, -1,
1997	-1, 311, -1, -1, -1, -1, -1, -1, 318, -1,
1998	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
1999	-1, -1, -1, -1, 334, -1, -1, -1, -1, 339,
2000	-1, -1, 342, -1, -1, -1, -1, -1, -1, 349,
2001	350, -1, -1, 123, -1, -1, -1, -1, -1, -1,
2002	10, -1, -1, -1, -1, 365, 366, 367, -1, -1,
2003	-1, -1, -1, 373, 374, 375, 376, 377, 378, 379,
2004	260, -1, -1, 33, -1, -1, -1, -1, -1, -1,
2005	270, -1, -1, -1, -1, -1, -1, -1, -1, 279,
2006	280, -1, 282, 283, -1, -1, 286, -1, -1, -1,
2007	290, -1, 292, 293, 294, 295, 296, -1, -1, 299,
2008	300, 301, -1, -1, -1, 305, -1, -1, -1, -1,
2009	-1, 311, -1, -1, -1, -1, -1, -1, 318, -1,
2010	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
2011	-1, -1, -1, -1, 334, -1, -1, -1, -1, 339,
2012	-1, 10, 342, -1, -1, -1, -1, -1, -1, 349,
2013	350, -1, -1, 123, -1, -1, -1, -1, -1, -1,
2014	-1, -1, -1, -1, 33, 365, 366, 367, -1, -1,
2015	260, -1, -1, 373, 374, 375, 376, 377, 378, 379,
2016	270, -1, -1, -1, -1, -1, -1, -1, -1, 279,
2017	280, -1, 282, 283, -1, -1, 286, -1, -1, -1,
2018	290, -1, 292, 293, 294, 295, 296, -1, -1, 299,
2019	300, 301, -1, -1, -1, 305, -1, -1, -1, -1,
2020	-1, 311, -1, -1, -1, -1, -1, -1, 318, -1,
2021	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
2022	-1, -1, 10, -1, 334, -1, -1, -1, -1, 339,
2023	-1, -1, 342, -1, 123, -1, -1, -1, -1, 349,
2024	350, -1, -1, -1, -1, 33, -1, -1, -1, -1,
2025	-1, -1, -1, -1, -1, 365, 366, 367, -1, -1,
2026	-1, -1, -1, 373, 374, 375, 376, 377, 378, 379,
2027	260, -1, -1, -1, -1, -1, -1, -1, -1, -1,
2028	270, -1, -1, -1, -1, -1, -1, -1, -1, 279,
2029	280, -1, 282, 283, -1, -1, 286, -1, -1, -1,
2030	290, -1, 292, 293, 294, 295, 296, -1, -1, 299,
2031	300, 301, -1, -1, -1, 305, -1, -1, -1, -1,
2032	-1, 311, -1, -1, -1, -1, -1, -1, 318, -1,
2033	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
2034	-1, -1, -1, -1, 334, -1, 33, -1, -1, 339,
2035	-1, -1, 342, -1, -1, -1, -1, -1, -1, 349,
2036	350, -1, -1, -1, -1, -1, -1, -1, -1, -1,
2037	-1, 260, -1, -1, -1, 365, 366, 367, -1, -1,
2038	-1, 270, -1, 373, 374, 375, 376, 377, 378, 379,
2039	279, 280, -1, 282, 283, -1, -1, 286, -1, -1,
2040	-1, 290, -1, 292, 293, 294, 295, 296, -1, -1,
2041	299, 300, 301, -1, -1, -1, 305, -1, -1, -1,
2042	-1, -1, 311, -1, -1, -1, -1, -1, -1, 318,
2043	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
2044	-1, -1, -1, -1, -1, 334, -1, -1, -1, -1,
2045	339, -1, -1, 342, -1, -1, -1, -1, -1, -1,
2046	349, 350, -1, -1, -1, -1, -1, -1, -1, -1,
2047	-1, -1, 260, -1, -1, -1, 365, 366, 367, -1,
2048	-1, -1, 270, -1, 373, 374, 375, 376, 377, 378,
2049	379, 279, 280, -1, 282, 283, -1, -1, 286, -1,
2050	-1, -1, 290, -1, 292, 293, 294, 295, 296, -1,
2051	-1, 299, 300, 301, -1, -1, -1, 305, -1, -1,
2052	-1, -1, -1, 311, -1, -1, -1, -1, -1, -1,
2053	318, -1, -1, -1, -1, -1, -1, -1, -1, -1,
2054	-1, -1, -1, -1, -1, -1, 334, -1, -1, -1,
2055	-1, 339, -1, -1, 342, -1, -1, -1, -1, -1,
2056	-1, 349, 350, -1, -1, -1, -1, -1, -1, -1,
2057	-1, -1, -1, 260, -1, -1, -1, 365, 366, 367,
2058	-1, -1, -1, 270, -1, 373, 374, 375, 376, 377,
2059	378, 379, 279, 280, -1, 282, 283, -1, -1, 286,
2060	-1, -1, -1, 290, -1, 292, 293, 294, 295, 296,
2061	-1, -1, 299, 300, 301, -1, -1, -1, 305, -1,
2062	-1, -1, -1, -1, 311, -1, -1, -1, -1, -1,
2063	-1, 318, -1, -1, -1, -1, -1, -1, -1, -1,
2064	-1, -1, -1, -1, -1, -1, -1, 334, -1, -1,
2065	-1, -1, 339, -1, -1, 342, -1, -1, -1, -1,
2066	-1, -1, 349, 350, -1, -1, -1, -1, -1, -1,
2067	-1, -1, -1, -1, -1, -1, -1, -1, 365, -1,
2068	367, -1, -1, -1, -1, -1, 373, 374, 375, 376,
2069	377, 378,
2070	};
2071	#define YYFINAL2 2
2072	#ifndef YYDEBUG0
2073	#define YYDEBUG0 0
2074	#endif
2075	#define YYMAXTOKEN385 385
2076	#if YYDEBUG0
2077	const char * const yyname[] =
2078	{
2079	"end-of-file",0,0,0,0,0,0,0,0,0,"'\\n'",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
2080	0,0,"'!'",0,0,0,0,0,0,"'('","')'",0,0,"','","'-'",0,"'/'",0,0,0,0,0,0,0,0,0,0,0,
2081	0,"'<'","'='","'>'",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
2082	0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,"'{'",0,"'}'",0,0,0,
2083	0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
2084	0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
2085	0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
2086	0,0,0,0,0,0,0,0,"PASS","BLOCK","MATCH","SCRUB","RETURN","IN","OS","OUT","LOG",
2087	"QUICK","ON","FROM","TO","FLAGS","RETURNRST","RETURNICMP","RETURNICMP6","PROTO",
2088	"INET","INET6","ALL","ANY","ICMPTYPE","ICMP6TYPE","CODE","KEEP","MODULATE",
2089	"STATE","PORT","BINATTO","NODF","MINTTL","ERROR","ALLOWOPTS","FILENAME",
2090	"ROUTETO","DUPTO","REPLYTO","NO","LABEL","NOROUTE","URPFFAILED","FRAGMENT",
2091	"USER","GROUP","MAXMSS","MAXIMUM","TTL","TOS","DROP","TABLE","REASSEMBLE",
2092	"ANCHOR","SYNCOOKIES","SET","OPTIMIZATION","TIMEOUT","LIMIT","LOGINTERFACE",
2093	"BLOCKPOLICY","RANDOMID","SYNPROXY","FINGERPRINTS","NOSYNC","DEBUG","SKIP",
2094	"HOSTID","ANTISPOOF","FOR","INCLUDE","MATCHES","BITMASK","RANDOM","SOURCEHASH",
2095	"ROUNDROBIN","LEASTSTATES","STATICPORT","PROBABILITY","WEIGHT","BANDWIDTH",
2096	"FLOWS","QUANTUM","QUEUE","PRIORITY","QLIMIT","RTABLE","RDOMAIN","MINIMUM",
2097	"BURST","PARENT","LOAD","RULESET_OPTIMIZATION","PRIO","ONCE","DEFAULT","DELAY",
2098	"STICKYADDRESS","MAXSRCSTATES","MAXSRCNODES","SOURCETRACK","GLOBAL","RULE",
2099	"MAXSRCCONN","MAXSRCCONNRATE","OVERLOAD","FLUSH","SLOPPY","PFLOW","MAXPKTRATE",
2100	"TAGGED","TAG","IFBOUND","FLOATING","STATEPOLICY","STATEDEFAULTS","ROUTE",
2101	"DIVERTTO","DIVERTREPLY","DIVERTPACKET","NATTO","AFTO","RDRTO","RECEIVEDON",
2102	"NE","LE","GE","STRING","NUMBER","PORTBINARY",
2103	};
2104	const char * const yyrule[] =
2105	{"$accept : ruleset",
2106	"ruleset :",
2107	"ruleset : ruleset include '\\n'",
2108	"ruleset : ruleset '\\n'",
2109	"ruleset : ruleset option '\\n'",
2110	"ruleset : ruleset pfrule '\\n'",
2111	"ruleset : ruleset anchorrule '\\n'",
2112	"ruleset : ruleset loadrule '\\n'",
2113	"ruleset : ruleset queuespec '\\n'",
2114	"ruleset : ruleset varset '\\n'",
2115	"ruleset : ruleset antispoof '\\n'",
2116	"ruleset : ruleset tabledef '\\n'",
2117	"ruleset : '{' fakeanchor '}' '\\n'",
2118	"ruleset : ruleset error '\\n'",
2119	"include : INCLUDE STRING",
2120	"fakeanchor : fakeanchor '\\n'",
2121	"fakeanchor : fakeanchor anchorrule '\\n'",
2122	"fakeanchor : fakeanchor pfrule '\\n'",
2123	"fakeanchor : fakeanchor error '\\n'",
2124	"optimizer : string",
2125	"optnodf :",
2126	"optnodf : NODF",
2127	"option : SET REASSEMBLE yesno optnodf",
2128	"option : SET OPTIMIZATION STRING",
2129	"option : SET RULESET_OPTIMIZATION optimizer",
2130	"option : SET TIMEOUT timeout_spec",
2131	"option : SET TIMEOUT '{' optnl timeout_list '}'",
2132	"option : SET LIMIT limit_spec",
2133	"option : SET LIMIT '{' optnl limit_list '}'",
2134	"option : SET LOGINTERFACE stringall",
2135	"option : SET HOSTID number",
2136	"option : SET BLOCKPOLICY DROP",
2137	"option : SET BLOCKPOLICY RETURN",
2138	"option : SET FINGERPRINTS STRING",
2139	"option : SET STATEPOLICY statelock",
2140	"option : SET DEBUG STRING",
2141	"option : SET DEBUG DEBUG",
2142	"option : SET SKIP interface",
2143	"option : SET STATEDEFAULTS state_opt_list",
2144	"option : SET SYNCOOKIES syncookie_val syncookie_opts",
2145	"syncookie_val : STRING",
2146	"syncookie_opts :",
2147	"$$1 :",
2148	"syncookie_opts : $$1 '(' syncookie_opt_l ')'",
2149	"syncookie_opt_l : syncookie_opt_l comma syncookie_opt",
2150	"syncookie_opt_l : syncookie_opt",
2151	"syncookie_opt : STRING STRING",
2152	"stringall : STRING",
2153	"stringall : ALL",
2154	"string : STRING string",
2155	"string : STRING",
2156	"varstring : numberstring varstring",
2157	"varstring : numberstring",
2158	"numberstring : NUMBER",
2159	"numberstring : STRING",
2160	"varset : STRING '=' varstring",
2161	"anchorname : STRING",
2162	"anchorname :",
2163	"pfa_anchorlist :",
2164	"pfa_anchorlist : pfa_anchorlist '\\n'",
2165	"pfa_anchorlist : pfa_anchorlist pfrule '\\n'",
2166	"pfa_anchorlist : pfa_anchorlist anchorrule '\\n'",
2167	"pfa_anchorlist : pfa_anchorlist include '\\n'",
2168	"$$2 :",
2169	"pfa_anchor : '{' $$2 '\\n' pfa_anchorlist '}'",
2170	"pfa_anchor :",
2171	"anchorrule : ANCHOR anchorname dir quick interface af proto fromto filter_opts pfa_anchor",
2172	"loadrule : LOAD ANCHOR anchorname FROM string",
2173	"$$3 :",
2174	"scrub_opts : $$3 scrub_opts_l",
2175	"scrub_opts_l : scrub_opts_l comma scrub_opt",
2176	"scrub_opts_l : scrub_opt",
2177	"scrub_opt : NODF",
2178	"scrub_opt : MINTTL NUMBER",
2179	"scrub_opt : MAXMSS NUMBER",
2180	"scrub_opt : REASSEMBLE STRING",
2181	"scrub_opt : RANDOMID",
2182	"antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts",
2183	"antispoof_ifspc : FOR antispoof_if",
2184	"antispoof_ifspc : FOR '{' optnl antispoof_iflst '}'",
2185	"antispoof_iflst : antispoof_if optnl",
2186	"antispoof_iflst : antispoof_iflst comma antispoof_if optnl",
2187	"antispoof_if : if_item",
2188	"antispoof_if : '(' if_item ')'",
2189	"$$4 :",
2190	"antispoof_opts : $$4 antispoof_opts_l",
2191	"antispoof_opts :",
2192	"antispoof_opts_l : antispoof_opts_l antispoof_opt",
2193	"antispoof_opts_l : antispoof_opt",
2194	"antispoof_opt : LABEL label",
2195	"antispoof_opt : RTABLE NUMBER",
2196	"not : '!'",
2197	"not :",
2198	"tabledef : TABLE '<' STRING '>' table_opts",
2199	"$$5 :",
2200	"table_opts : $$5 table_opts_l",
2201	"table_opts :",
2202	"table_opts_l : table_opts_l table_opt",
2203	"table_opts_l : table_opt",
2204	"table_opt : STRING",
2205	"table_opt : '{' optnl '}'",
2206	"table_opt : '{' optnl table_host_list '}'",
2207	"table_opt : FILENAME STRING",
2208	"tablespec : xhost optweight",
2209	"tablespec : '{' optnl table_host_list '}'",
2210	"table_host_list : tablespec optnl",
2211	"table_host_list : table_host_list comma tablespec optnl",
2212	"queuespec : QUEUE STRING interface queue_opts",
2213	"$$6 :",
2214	"queue_opts : $$6 queue_opts_l",
2215	"queue_opts_l : queue_opts_l queue_opt",
2216	"queue_opts_l : queue_opt",
2217	"queue_opt : BANDWIDTH scspec optscs",
2218	"queue_opt : PARENT STRING",
2219	"queue_opt : DEFAULT",
2220	"queue_opt : QLIMIT NUMBER",
2221	"queue_opt : FLOWS NUMBER",
2222	"queue_opt : QUANTUM NUMBER",
2223	"optscs :",
2224	"optscs : comma MINIMUM scspec",
2225	"optscs : comma MAXIMUM scspec",
2226	"optscs : comma MINIMUM scspec comma MAXIMUM scspec",
2227	"optscs : comma MAXIMUM scspec comma MINIMUM scspec",
2228	"scspec : bandwidth",
2229	"scspec : bandwidth BURST bandwidth FOR STRING",
2230	"bandwidth : STRING",
2231	"bandwidth : NUMBER",
2232	"pfrule : action dir logquick interface af proto fromto filter_opts",
2233	"$$7 :",
2234	"filter_opts : $$7 filter_opts_l",
2235	"filter_opts :",
2236	"filter_opts_l : filter_opts_l filter_opt",
2237	"filter_opts_l : filter_opt",
2238	"filter_opt : USER uids",
2239	"filter_opt : GROUP gids",
2240	"filter_opt : flags",
2241	"filter_opt : icmpspec",
2242	"filter_opt : PRIO NUMBER",
2243	"filter_opt : TOS tos",
2244	"filter_opt : keep",
2245	"filter_opt : FRAGMENT",
2246	"filter_opt : ALLOWOPTS",
2247	"filter_opt : LABEL label",
2248	"filter_opt : QUEUE qname",
2249	"filter_opt : TAG string",
2250	"filter_opt : not TAGGED string",
2251	"filter_opt : PROBABILITY probability",
2252	"filter_opt : RTABLE NUMBER",
2253	"filter_opt : DIVERTTO STRING PORT portplain",
2254	"filter_opt : DIVERTREPLY",
2255	"filter_opt : DIVERTPACKET PORT portplain",
2256	"filter_opt : SCRUB '(' scrub_opts ')'",
2257	"filter_opt : NATTO redirpool pool_opts",
2258	"filter_opt : AFTO af FROM redirpool pool_opts",
2259	"filter_opt : AFTO af FROM redirpool pool_opts TO redirpool pool_opts",
2260	"filter_opt : RDRTO redirpool pool_opts",
2261	"filter_opt : BINATTO redirpool pool_opts",
2262	"filter_opt : ROUTETO routespec",
2263	"filter_opt : REPLYTO routespec",
2264	"filter_opt : DUPTO routespec",
2265	"filter_opt : not RECEIVEDON if_item",
2266	"filter_opt : ONCE",
2267	"filter_opt : MAXPKTRATE NUMBER '/' NUMBER",
2268	"filter_opt : filter_sets",
2269	"filter_sets : SET '(' filter_sets_l ')'",
2270	"filter_sets : SET filter_set",
2271	"filter_sets_l : filter_sets_l comma filter_set",
2272	"filter_sets_l : filter_set",
2273	"filter_set : prio",
2274	"filter_set : QUEUE qname",
2275	"filter_set : TOS tos",
2276	"filter_set : DELAY NUMBER",
2277	"prio : PRIO NUMBER",
2278	"prio : PRIO '(' NUMBER comma NUMBER ')'",
2279	"probability : STRING",
2280	"probability : NUMBER",
2281	"action : PASS",
2282	"action : MATCH",
2283	"action : BLOCK blockspec",
2284	"blockspec :",
2285	"blockspec : DROP",
2286	"blockspec : RETURNRST",
2287	"blockspec : RETURNRST '(' TTL NUMBER ')'",
2288	"blockspec : RETURNICMP",
2289	"blockspec : RETURNICMP6",
2290	"blockspec : RETURNICMP '(' reticmpspec ')'",
2291	"blockspec : RETURNICMP6 '(' reticmp6spec ')'",
2292	"blockspec : RETURNICMP '(' reticmpspec comma reticmp6spec ')'",
2293	"blockspec : RETURN",
2294	"reticmpspec : STRING",
2295	"reticmpspec : NUMBER",
2296	"reticmp6spec : STRING",
2297	"reticmp6spec : NUMBER",
2298	"dir :",
2299	"dir : IN",
2300	"dir : OUT",
2301	"quick :",
2302	"quick : QUICK",
2303	"logquick :",
2304	"logquick : log",
2305	"logquick : QUICK",
2306	"logquick : log QUICK",
2307	"logquick : QUICK log",
2308	"log : LOG",
2309	"log : LOG '(' logopts ')'",
2310	"logopts : logopt",
2311	"logopts : logopts comma logopt",
2312	"logopt : ALL",
2313	"logopt : MATCHES",
2314	"logopt : USER",
2315	"logopt : TO string",
2316	"interface :",
2317	"interface : ON if_item_not",
2318	"interface : ON '{' optnl if_list '}'",
2319	"if_list : if_item_not optnl",
2320	"if_list : if_list comma if_item_not optnl",
2321	"if_item_not : not if_item",
2322	"if_item : STRING",
2323	"if_item : ANY",
2324	"if_item : RDOMAIN NUMBER",
2325	"af :",
2326	"af : INET",
2327	"af : INET6",
2328	"proto :",
2329	"proto : PROTO proto_item",
2330	"proto : PROTO '{' optnl proto_list '}'",
2331	"proto_list : proto_item optnl",
2332	"proto_list : proto_list comma proto_item optnl",
2333	"proto_item : protoval",
2334	"protoval : STRING",
2335	"protoval : NUMBER",
2336	"fromto : ALL",
2337	"fromto : from os to",
2338	"os :",
2339	"os : OS xos",
2340	"os : OS '{' optnl os_list '}'",
2341	"xos : STRING",
2342	"os_list : xos optnl",
2343	"os_list : os_list comma xos optnl",
2344	"from :",
2345	"from : FROM ipportspec",
2346	"to :",
2347	"to : TO ipportspec",
2348	"ipportspec : ipspec",
2349	"ipportspec : ipspec PORT portspec",
2350	"ipportspec : PORT portspec",
2351	"optnl : '\\n' optnl",
2352	"optnl :",
2353	"ipspec : ANY",
2354	"ipspec : xhost",
2355	"ipspec : '{' optnl host_list '}'",
2356	"host_list : ipspec optnl",
2357	"host_list : host_list comma ipspec optnl",
2358	"xhost : not host",
2359	"xhost : not NOROUTE",
2360	"xhost : not URPFFAILED",
2361	"optweight : WEIGHT NUMBER",
2362	"optweight :",
2363	"host : STRING",
2364	"host : STRING '-' STRING",
2365	"host : STRING '/' NUMBER",
2366	"host : NUMBER '/' NUMBER",
2367	"host : dynaddr",
2368	"host : dynaddr '/' NUMBER",
2369	"host : '<' STRING '>'",
2370	"host : ROUTE STRING",
2371	"number : NUMBER",
2372	"number : STRING",
2373	"dynaddr : '(' STRING ')'",
2374	"portspec : port_item",
2375	"portspec : '{' optnl port_list '}'",
2376	"port_list : port_item optnl",
2377	"port_list : port_list comma port_item optnl",
2378	"port_item : portrange",
2379	"port_item : unaryop portrange",
2380	"port_item : portrange PORTBINARY portrange",
2381	"portplain : numberstring",
2382	"portrange : numberstring",
2383	"uids : uid_item",
2384	"uids : '{' optnl uid_list '}'",
2385	"uid_list : uid_item optnl",
2386	"uid_list : uid_list comma uid_item optnl",
2387	"uid_item : uid",
2388	"uid_item : unaryop uid",
2389	"uid_item : uid PORTBINARY uid",
2390	"uid : STRING",
2391	"uid : NUMBER",
2392	"gids : gid_item",
2393	"gids : '{' optnl gid_list '}'",
2394	"gid_list : gid_item optnl",
2395	"gid_list : gid_list comma gid_item optnl",
2396	"gid_item : gid",
2397	"gid_item : unaryop gid",
2398	"gid_item : gid PORTBINARY gid",
2399	"gid : STRING",
2400	"gid : NUMBER",
2401	"flag : STRING",
2402	"flags : FLAGS flag '/' flag",
2403	"flags : FLAGS '/' flag",
2404	"flags : FLAGS ANY",
2405	"icmpspec : ICMPTYPE icmp_item",
2406	"icmpspec : ICMPTYPE '{' optnl icmp_list '}'",
2407	"icmpspec : ICMP6TYPE icmp6_item",
2408	"icmpspec : ICMP6TYPE '{' optnl icmp6_list '}'",
2409	"icmp_list : icmp_item optnl",
2410	"icmp_list : icmp_list comma icmp_item optnl",
2411	"icmp6_list : icmp6_item optnl",
2412	"icmp6_list : icmp6_list comma icmp6_item optnl",
2413	"icmp_item : icmptype",
2414	"icmp_item : icmptype CODE STRING",
2415	"icmp_item : icmptype CODE NUMBER",
2416	"icmp6_item : icmp6type",
2417	"icmp6_item : icmp6type CODE STRING",
2418	"icmp6_item : icmp6type CODE NUMBER",
2419	"icmptype : STRING",
2420	"icmptype : NUMBER",
2421	"icmp6type : STRING",
2422	"icmp6type : NUMBER",
2423	"tos : STRING",
2424	"tos : NUMBER",
2425	"sourcetrack :",
2426	"sourcetrack : GLOBAL",
2427	"sourcetrack : RULE",
2428	"statelock : IFBOUND",
2429	"statelock : FLOATING",
2430	"keep : NO STATE",
2431	"keep : KEEP STATE state_opt_spec",
2432	"keep : MODULATE STATE state_opt_spec",
2433	"keep : SYNPROXY STATE state_opt_spec",
2434	"flush :",
2435	"flush : FLUSH",
2436	"flush : FLUSH GLOBAL",
2437	"state_opt_spec : '(' state_opt_list ')'",
2438	"state_opt_spec :",
2439	"state_opt_list : state_opt_item",
2440	"state_opt_list : state_opt_list comma state_opt_item",
2441	"state_opt_item : MAXIMUM NUMBER",
2442	"state_opt_item : NOSYNC",
2443	"state_opt_item : MAXSRCSTATES NUMBER",
2444	"state_opt_item : MAXSRCCONN NUMBER",
2445	"state_opt_item : MAXSRCCONNRATE NUMBER '/' NUMBER",
2446	"state_opt_item : OVERLOAD '<' STRING '>' flush",
2447	"state_opt_item : MAXSRCNODES NUMBER",
2448	"state_opt_item : SOURCETRACK sourcetrack",
2449	"state_opt_item : statelock",
2450	"state_opt_item : SLOPPY",
2451	"state_opt_item : PFLOW",
2452	"state_opt_item : STRING NUMBER",
2453	"label : STRING",
2454	"qname : STRING",
2455	"qname : '(' STRING ')'",
2456	"qname : '(' STRING comma STRING ')'",
2457	"portstar : numberstring",
2458	"redirspec : host optweight",
2459	"redirspec : '{' optnl redir_host_list '}'",
2460	"redir_host_list : host optweight optnl",
2461	"redir_host_list : redir_host_list comma host optweight optnl",
2462	"redirpool : redirspec",
2463	"redirpool : redirspec PORT portstar",
2464	"hashkey :",
2465	"hashkey : string",
2466	"$$8 :",
2467	"pool_opts : $$8 pool_opts_l",
2468	"pool_opts :",
2469	"pool_opts_l : pool_opts_l pool_opt",
2470	"pool_opts_l : pool_opt",
2471	"pool_opt : BITMASK",
2472	"pool_opt : RANDOM",
2473	"pool_opt : SOURCEHASH hashkey",
2474	"pool_opt : ROUNDROBIN",
2475	"pool_opt : LEASTSTATES",
2476	"pool_opt : STATICPORT",
2477	"pool_opt : STICKYADDRESS",
2478	"routespec : redirspec pool_opts",
2479	"timeout_spec : STRING NUMBER",
2480	"timeout_list : timeout_list comma timeout_spec optnl",
2481	"timeout_list : timeout_spec optnl",
2482	"limit_spec : STRING NUMBER",
2483	"limit_list : limit_list comma limit_spec optnl",
2484	"limit_list : limit_spec optnl",
2485	"comma : ','",
2486	"comma :",
2487	"yesno : NO",
2488	"yesno : STRING",
2489	"unaryop : '='",
2490	"unaryop : NE",
2491	"unaryop : LE",
2492	"unaryop : '<'",
2493	"unaryop : GE",
2494	"unaryop : '>'",
2495	};
2496	#endif
2497	#ifdef YYSTACKSIZE10000
2498	#undef YYMAXDEPTH10000
2499	#define YYMAXDEPTH10000 YYSTACKSIZE10000
2500	#else
2501	#ifdef YYMAXDEPTH10000
2502	#define YYSTACKSIZE10000 YYMAXDEPTH10000
2503	#else
2504	#define YYSTACKSIZE10000 10000
2505	#define YYMAXDEPTH10000 10000
2506	#endif
2507	#endif
2508	#define YYINITSTACKSIZE200 200
2509	/* LINTUSED */
2510	int yydebug;
2511	int yynerrs;
2512	int yyerrflag;
2513	int yychar;
2514	short *yyssp;
2515	YYSTYPE *yyvsp;
2516	YYSTYPE yyval;
2517	YYSTYPE yylval;
2518	short *yyss;
2519	short *yysslim;
2520	YYSTYPE *yyvs;
2521	unsigned int yystacksize;
2522	int yyparse(void);
2523	#line 3778 "/usr/src/sbin/pfctl/parse.y"
2524
2525	int
2526	yyerror(const char *fmt, ...)
2527	{
2528	va_list ap;
2529
2530	file->errors++;
2531	va_start(ap, fmt)__builtin_va_start((ap), fmt);
2532	fprintf(stderr(&__sF[2]), "%s:%d: ", file->name, yylval.lineno);
2533	vfprintf(stderr(&__sF[2]), fmt, ap);
2534	fprintf(stderr(&__sF[2]), "\n");
2535	va_end(ap)__builtin_va_end((ap));
2536	return (0);
2537	}
2538
2539	int
2540	validate_range(u_int8_t op, u_int16_t p1, u_int16_t p2)
2541	{
2542	u_int16_t a = ntohs(p1)(__uint16_t)(__builtin_constant_p(p1) ? (__uint16_t)(((__uint16_t )(p1) & 0xffU) << 8 \| ((__uint16_t)(p1) & 0xff00U ) >> 8) : __swap16md(p1));
2543	u_int16_t b = ntohs(p2)(__uint16_t)(__builtin_constant_p(p2) ? (__uint16_t)(((__uint16_t )(p2) & 0xffU) << 8 \| ((__uint16_t)(p2) & 0xff00U ) >> 8) : __swap16md(p2));
2544
2545	if ((op == PF_OP_RRG && a > b) \|\| /* 34:12, i.e. none */
2546	(op == PF_OP_IRG && a >= b) \|\| /* 34><12, i.e. none */
2547	(op == PF_OP_XRG && a > b)) /* 34<>22, i.e. all */
2548	return 1;
2549	return 0;
2550	}
2551
2552	int
2553	disallow_table(struct node_host h, const char fmt)
2554	{
2555	for (; h != NULL((void *)0); h = h->next)
2556	if (h->addr.type == PF_ADDR_TABLE) {
2557	yyerror(fmt, h->addr.v.tblname);
2558	return (1);
2559	}
2560	return (0);
2561	}
2562
2563	int
2564	disallow_urpf_failed(struct node_host h, const char fmt)
2565	{
2566	for (; h != NULL((void *)0); h = h->next)
2567	if (h->addr.type == PF_ADDR_URPFFAILED) {
2568	yyerror("%s", fmt);
2569	return (1);
2570	}
2571	return (0);
2572	}
2573
2574	int
2575	disallow_alias(struct node_host h, const char fmt)
2576	{
2577	for (; h != NULL((void *)0); h = h->next)
2578	if (DYNIF_MULTIADDR(h->addr)((h->addr).type == PF_ADDR_DYNIFTL && (!((h->addr ).iflags & 0x08) \|\| !isdigit((unsigned char)(h->addr). v.ifname[strlen((h->addr).v.ifname)-1])))) {
2579	yyerror(fmt, h->addr.v.tblname);
2580	return (1);
2581	}
2582	return (0);
2583	}
2584
2585	int
2586	rule_consistent(struct pf_rule *r)
2587	{
2588	int problems = 0;
2589
2590	if (r->proto != IPPROTO_TCP6 && r->os_fingerprint != PF_OSFP_ANY((pf_osfp_t)0)) {
2591	yyerror("os only applies to tcp");
2592	problems++;
2593	}
2594	if (r->proto != IPPROTO_TCP6 && r->proto != IPPROTO_UDP17 &&
2595	(r->src.port_op \|\| r->dst.port_op)) {
2596	yyerror("port only applies to tcp/udp");
2597	problems++;
2598	}
2599	if (r->proto != IPPROTO_TCP6 && r->proto != IPPROTO_UDP17 &&
2600	r->uid.op) {
2601	yyerror("user only applies to tcp/udp");
2602	problems++;
2603	}
2604	if (r->proto != IPPROTO_TCP6 && r->proto != IPPROTO_UDP17 &&
2605	r->gid.op) {
2606	yyerror("group only applies to tcp/udp");
2607	problems++;
2608	}
2609	if (r->proto != IPPROTO_ICMP1 && r->proto != IPPROTO_ICMPV658 &&
2610	(r->type \|\| r->code)) {
2611	yyerror("icmp-type/code only applies to icmp");
2612	problems++;
2613	}
2614	if (!r->af && (r->type \|\| r->code)) {
2615	yyerror("must indicate address family with icmp-type/code");
2616	problems++;
2617	}
2618	if (r->rule_flag & PFRULE_AFTO0x00200000 && r->af == r->naf) {
2619	yyerror("must indicate different address family with af-to");
2620	problems++;
2621	}
2622	if (r->overload_tblname[0] &&
2623	r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) {
2624	yyerror("'overload' requires 'max-src-conn' "
2625	"or 'max-src-conn-rate'");
2626	problems++;
2627	}
2628	if ((r->proto == IPPROTO_ICMP1 && r->af == AF_INET624) \|\|
2629	(r->proto == IPPROTO_ICMPV658 && r->af == AF_INET2)) {
2630	yyerror("proto %s doesn't match address family %s",
2631	r->proto == IPPROTO_ICMP1 ? "icmp" : "icmp6",
2632	r->af == AF_INET2 ? "inet" : "inet6");
2633	problems++;
2634	}
2635	if (r->allow_opts && r->action != PF_PASS) {
2636	yyerror("allow-opts can only be specified for pass rules");
2637	problems++;
2638	}
2639	if (r->rule_flag & PFRULE_FRAGMENT0x0002 && (r->src.port_op \|\|
2640	r->dst.port_op \|\| r->flagset \|\| r->type \|\| r->code)) {
2641	yyerror("fragments can be filtered only on IP header fields");
2642	problems++;
2643	}
2644	if (r->rule_flag & PFRULE_RETURNRST0x0001 && r->proto != IPPROTO_TCP6) {
2645	yyerror("return-rst can only be applied to TCP rules");
2646	problems++;
2647	}
2648	if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK0x0040)) {
2649	yyerror("max-src-nodes requires 'source-track rule'");
2650	problems++;
2651	}
2652	if (r->action != PF_PASS && r->keep_state) {
2653	yyerror("keep state is great, but only for pass rules");
2654	problems++;
2655	}
2656	if (r->rt && !r->keep_state) {
2657	yyerror("route-to, reply-to and dup-to require keep state");
2658	problems++;
2659	}
2660	if (r->rule_flag & PFRULE_STATESLOPPY0x00020000 &&
2661	(r->keep_state == PF_STATE_MODULATE0x2 \|\|
2662	r->keep_state == PF_STATE_SYNPROXY0x3)) {
2663	yyerror("sloppy state matching cannot be used with "
2664	"synproxy state or modulate state");
2665	problems++;
2666	}
2667
2668	if ((r->keep_state == PF_STATE_SYNPROXY0x3) && (r->direction != PF_IN))
2669	fprintf(stderr(&__sF[2]), "%s:%d: warning: "
2670	"synproxy used for inbound rules only, "
2671	"ignored for outbound\n", file->name, yylval.lineno);
2672
2673	if ((r->nat.addr.type != PF_ADDR_NONE \|\|
2674	r->rdr.addr.type != PF_ADDR_NONE) &&
2675	r->action != PF_MATCH && !r->keep_state) {
2676	yyerror("nat-to and rdr-to require keep state");
2677	problems++;
2678	}
2679	if (r->direction == PF_INOUT && (r->nat.addr.type != PF_ADDR_NONE \|\|
2680	r->rdr.addr.type != PF_ADDR_NONE)) {
2681	yyerror("nat-to and rdr-to require a direction");
2682	problems++;
2683	}
2684	if (r->af == AF_INET624 && (r->scrub_flags &
2685	(PFSTATE_NODF0x0020\|PFSTATE_RANDOMID0x0080))) {
2686	yyerror("address family inet6 does not support scrub options "
2687	"no-df, random-id");
2688	problems++;
2689	}
2690
2691	/* Basic rule sanity check. */
2692	switch (r->action) {
2693	case PF_MATCH:
2694	if (r->divert.type != PF_DIVERT_NONE) {
2695	yyerror("divert is not supported on match rules");
2696	problems++;
2697	}
2698	if (r->rt) {
2699	yyerror("route-to, reply-to and dup-to "
2700	"are not supported on match rules");
2701	problems++;
2702	}
2703	if (r->rule_flag & PFRULE_AFTO0x00200000) {
2704	yyerror("af-to is not supported on match rules");
2705	problems++;
2706	}
2707	break;
2708	case PF_DROP:
2709	if (r->rt) {
2710	yyerror("route-to, reply-to and dup-to "
2711	"are not supported on block rules");
2712	problems++;
2713	}
2714	break;
2715	default:;
2716	}
2717	return (-problems);
2718	}
2719
2720	int
2721	process_tabledef(char name, struct table_opts opts, int popts)
2722	{
2723	struct pfr_buffer ab;
2724	struct node_tinit *ti;
2725
2726	bzero(&ab, sizeof(ab));
2727	ab.pfrb_type = PFRB_ADDRS;
2728	SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries)for((ti) = ((&opts->init_nodes)->sqh_first); (ti) != ((void *)0); (ti) = ((ti)->entries.sqe_next)) {
2729	if (ti->file)
2730	if (pfr_buf_load(&ab, ti->file, 0, popts)) {
2731	if (errno(*__errno()))
2732	yyerror("cannot load \"%s\": %s",
2733	ti->file, strerror(errno(*__errno())));
2734	else
2735	yyerror("file \"%s\" contains bad data",
2736	ti->file);
2737	goto _error;
2738	}
2739	if (ti->host)
2740	if (append_addr_host(&ab, ti->host, 0, 0)) {
2741	yyerror("cannot create address buffer: %s",
2742	strerror(errno(*__errno())));
2743	goto _error;
2744	}
2745	}
2746	if (pf->opts & PF_OPT_VERBOSE0x00004)
2747	print_tabledef(name, opts->flags, opts->init_addr,
2748	&opts->init_nodes);
2749	if (!(pf->opts & PF_OPT_NOACTION0x00008) \|\|
2750	(pf->opts & PF_OPT_DUMMYACTION0x00100))
2751	warn_duplicate_tables(name, pf->anchor->path);
2752	else if (pf->opts & PF_OPT_VERBOSE0x00004)
2753	fprintf(stderr(&__sF[2]), "%s:%d: skipping duplicate table checks"
2754	" for <%s>\n", file->name, yylval.lineno, name);
2755	if (!(pf->opts & PF_OPT_NOACTION0x00008) &&
2756	pfctl_define_table(name, opts->flags, opts->init_addr,
2757	pf->anchor->path, &ab, pf->anchor->ruleset.tticket)) {
2758	yyerror("cannot define table %s: %s", name,
2759	pf_strerror(errno(*__errno())));
2760	goto _error;
2761	}
2762	pf->tdirty = 1;
2763	pfr_buf_clear(&ab);
2764	return (0);
2765	_error:
2766	pfr_buf_clear(&ab);
2767	return (-1);
2768	}
2769
2770	struct keywords {
2771	const char *k_name;
2772	int k_val;
2773	};
2774
2775	/* macro gore, but you should've seen the prior indentation nightmare... */
2776
2777	#define FREE_LIST(T,r) \
2778	do { \
2779	T p, node = r; \
2780	while (node != NULL((void *)0)) { \
2781	p = node; \
2782	node = node->next; \
2783	free(p); \
2784	} \
2785	} while (0)
2786
2787	#define LOOP_THROUGH(T,n,r,C) \
2788	do { \
2789	T *n; \
2790	if (r == NULL((void *)0)) { \
2791	r = calloc(1, sizeof(T)); \
2792	if (r == NULL((void *)0)) \
2793	err(1, "LOOP: calloc"); \
2794	r->next = NULL((void *)0); \
2795	} \
2796	n = r; \
2797	while (n != NULL((void *)0)) { \
2798	do { \
2799	C; \
2800	} while (0); \
2801	n = n->next; \
2802	} \
2803	} while (0)
2804
2805	void
2806	expand_label_str(char label, size_t len, const char srch, const char *repl)
2807	{
2808	char *tmp;
2809	char p, q;
2810
2811	if ((tmp = calloc(1, len)) == NULL((void *)0))
2812	err(1, "%s", __func__);
2813	p = q = label;
2814	while ((q = strstr(p, srch)) != NULL((void *)0)) {
2815	*q = '\0';
2816	if ((strlcat(tmp, p, len) >= len) \|\|
2817	(strlcat(tmp, repl, len) >= len))
2818	errx(1, "expand_label: label too long");
2819	q += strlen(srch);
2820	p = q;
2821	}
2822	if (strlcat(tmp, p, len) >= len)
2823	errx(1, "expand_label: label too long");
2824	strlcpy(label, tmp, len); /* always fits */
2825	free(tmp);
2826	}
2827
2828	void
2829	expand_label_if(const char name, char label, size_t len, const char *ifname)
2830	{
2831	if (strstr(label, name) != NULL((void *)0)) {
2832	if (!*ifname)
2833	expand_label_str(label, len, name, "any");
2834	else
2835	expand_label_str(label, len, name, ifname);
2836	}
2837	}
2838
2839	void
2840	expand_label_addr(const char name, char label, size_t len, sa_family_t af,
2841	struct node_host *h)
2842	{
2843	char tmp[64], tmp_not[66];
2844
2845	if (strstr(label, name) != NULL((void *)0)) {
2846	switch (h->addr.type) {
2847	case PF_ADDR_DYNIFTL:
2848	snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname);
2849	break;
2850	case PF_ADDR_TABLE:
2851	snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname);
2852	break;
2853	case PF_ADDR_NOROUTE:
2854	snprintf(tmp, sizeof(tmp), "no-route");
2855	break;
2856	case PF_ADDR_URPFFAILED:
2857	snprintf(tmp, sizeof(tmp), "urpf-failed");
2858	break;
2859	case PF_ADDR_ADDRMASK:
2860	if (!af \|\| (PF_AZERO(&h->addr.v.a.addr, af)((af == 2 && !(&h->addr.v.a.addr)->pfa.addr32 [0]) \|\| (af == 24 && !(&h->addr.v.a.addr)-> pfa.addr32[0] && !(&h->addr.v.a.addr)->pfa. addr32[1] && !(&h->addr.v.a.addr)->pfa.addr32 [2] && !(&h->addr.v.a.addr)->pfa.addr32[3] ) ) &&
2861	PF_AZERO(&h->addr.v.a.mask, af)((af == 2 && !(&h->addr.v.a.mask)->pfa.addr32 [0]) \|\| (af == 24 && !(&h->addr.v.a.mask)-> pfa.addr32[0] && !(&h->addr.v.a.mask)->pfa. addr32[1] && !(&h->addr.v.a.mask)->pfa.addr32 [2] && !(&h->addr.v.a.mask)->pfa.addr32[3] ) )))
2862	snprintf(tmp, sizeof(tmp), "any");
2863	else {
2864	char a[48];
2865	int bits;
2866
2867	if (inet_ntop(af, &h->addr.v.a.addr, a,
2868	sizeof(a)) == NULL((void *)0))
2869	snprintf(tmp, sizeof(tmp), "?");
2870	else {
2871	bits = unmask(&h->addr.v.a.mask);
2872	if ((af == AF_INET2 && bits < 32) \|\|
2873	(af == AF_INET624 && bits < 128))
2874	snprintf(tmp, sizeof(tmp),
2875	"%s/%d", a, bits);
2876	else
2877	snprintf(tmp, sizeof(tmp),
2878	"%s", a);
2879	}
2880	}
2881	break;
2882	default:
2883	snprintf(tmp, sizeof(tmp), "?");
2884	break;
2885	}
2886
2887	if (h->not) {
2888	snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp);
2889	expand_label_str(label, len, name, tmp_not);
2890	} else
2891	expand_label_str(label, len, name, tmp);
2892	}
2893	}
2894
2895	void
2896	expand_label_port(const char name, char label, size_t len,
2897	struct node_port *port)
2898	{
2899	char a1[6], a2[6], op[13] = "";
2900
2901	if (strstr(label, name) != NULL((void *)0)) {
2902	snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])(__uint16_t)(__builtin_constant_p(port->port[0]) ? (__uint16_t )(((__uint16_t)(port->port[0]) & 0xffU) << 8 \| ( (__uint16_t)(port->port[0]) & 0xff00U) >> 8) : __swap16md (port->port[0])));
2903	snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])(__uint16_t)(__builtin_constant_p(port->port[1]) ? (__uint16_t )(((__uint16_t)(port->port[1]) & 0xffU) << 8 \| ( (__uint16_t)(port->port[1]) & 0xff00U) >> 8) : __swap16md (port->port[1])));
2904	if (!port->op)
2905	;
2906	else if (port->op == PF_OP_IRG)
2907	snprintf(op, sizeof(op), "%s><%s", a1, a2);
2908	else if (port->op == PF_OP_XRG)
2909	snprintf(op, sizeof(op), "%s<>%s", a1, a2);
2910	else if (port->op == PF_OP_EQ)
2911	snprintf(op, sizeof(op), "%s", a1);
2912	else if (port->op == PF_OP_NE)
2913	snprintf(op, sizeof(op), "!=%s", a1);
2914	else if (port->op == PF_OP_LT)
2915	snprintf(op, sizeof(op), "<%s", a1);
2916	else if (port->op == PF_OP_LE)
2917	snprintf(op, sizeof(op), "<=%s", a1);
2918	else if (port->op == PF_OP_GT)
2919	snprintf(op, sizeof(op), ">%s", a1);
2920	else if (port->op == PF_OP_GE)
2921	snprintf(op, sizeof(op), ">=%s", a1);
2922	expand_label_str(label, len, name, op);
2923	}
2924	}
2925
2926	void
2927	expand_label_proto(const char name, char label, size_t len, u_int8_t proto)
2928	{
2929	struct protoent *pe;
2930	char n[4];
2931
2932	if (strstr(label, name) != NULL((void *)0)) {
2933	pe = getprotobynumber(proto);
2934	if (pe != NULL((void *)0))
2935	expand_label_str(label, len, name, pe->p_name);
2936	else {
2937	snprintf(n, sizeof(n), "%u", proto);
2938	expand_label_str(label, len, name, n);
2939	}
2940	}
2941	}
2942
2943	void
2944	pfctl_expand_label_nr(struct pf_rule *r, unsigned int rno)
2945	{
2946	char n[11];
2947
2948	snprintf(n, sizeof(n), "%u", rno);
2949
2950	if (strstr(r->label, "$nr") != NULL((void *)0))
2951	expand_label_str(r->label, PF_RULE_LABEL_SIZE64, "$nr", n);
2952
2953	if (strstr(r->tagname, "$nr") != NULL((void *)0))
2954	expand_label_str(r->tagname, PF_TAG_NAME_SIZE64, "$nr", n);
2955
2956	if (strstr(r->match_tagname, "$nr") != NULL((void *)0))
2957	expand_label_str(r->match_tagname, PF_TAG_NAME_SIZE64, "$nr", n);
2958	}
2959
2960	void
2961	expand_label(char label, size_t len, const char ifname, sa_family_t af,
2962	struct node_host src_host, struct node_port src_port,
2963	struct node_host dst_host, struct node_port dst_port,
2964	u_int8_t proto)
2965	{
2966	expand_label_if("$if", label, len, ifname);
2967	expand_label_addr("$srcaddr", label, len, af, src_host);
2968	expand_label_addr("$dstaddr", label, len, af, dst_host);
2969	expand_label_port("$srcport", label, len, src_port);
2970	expand_label_port("$dstport", label, len, dst_port);
2971	expand_label_proto("$proto", label, len, proto);
2972	/* rule number, '$nr', gets expanded after optimizer */
2973	}
2974
2975	int
2976	expand_queue(char qname, struct node_if interfaces, struct queue_opts *opts)
2977	{
2978	struct pf_queuespec qspec;
2979
2980	LOOP_THROUGH(struct node_if, interface, interfaces,
2981	bzero(&qspec, sizeof(qspec));
2982	if (!opts->parent && (opts->marker & QOM_BWSPEC0x01))
2983	opts->flags \|= PFQS_ROOTCLASS0x0002;
2984	if (!(opts->marker & QOM_BWSPEC0x01) &&
2985	!(opts->marker & QOM_FLOWS0x10)) {
2986	yyerror("no bandwidth or flow specification");
2987	return (1);
2988	}
2989	if (strlcpy(qspec.qname, qname, sizeof(qspec.qname)) >=
2990	sizeof(qspec.qname)) {
2991	yyerror("queuename too long");
2992	return (1);
2993	}
2994	if (opts->parent && strlcpy(qspec.parent, opts->parent,
2995	sizeof(qspec.parent)) >= sizeof(qspec.parent)) {
2996	yyerror("parent too long");
2997	return (1);
2998	}
2999	if (strlcpy(qspec.ifname, interface->ifname,
3000	sizeof(qspec.ifname)) >= sizeof(qspec.ifname)) {
3001	yyerror("interface too long");
3002	return (1);
3003	}
3004	qspec.realtime.m1.absolute = opts->realtime.m1.bw_absolute;
3005	qspec.realtime.m1.percent = opts->realtime.m1.bw_percent;
3006	qspec.realtime.m2.absolute = opts->realtime.m2.bw_absolute;
3007	qspec.realtime.m2.percent = opts->realtime.m2.bw_percent;
3008	qspec.realtime.d = opts->realtime.d;
3009
3010	qspec.linkshare.m1.absolute = opts->linkshare.m1.bw_absolute;
3011	qspec.linkshare.m1.percent = opts->linkshare.m1.bw_percent;
3012	qspec.linkshare.m2.absolute = opts->linkshare.m2.bw_absolute;
3013	qspec.linkshare.m2.percent = opts->linkshare.m2.bw_percent;
3014	qspec.linkshare.d = opts->linkshare.d;
3015
3016	qspec.upperlimit.m1.absolute = opts->upperlimit.m1.bw_absolute;
3017	qspec.upperlimit.m1.percent = opts->upperlimit.m1.bw_percent;
3018	qspec.upperlimit.m2.absolute = opts->upperlimit.m2.bw_absolute;
3019	qspec.upperlimit.m2.percent = opts->upperlimit.m2.bw_percent;
3020	qspec.upperlimit.d = opts->upperlimit.d;
3021
3022	qspec.flowqueue.flows = opts->flowqueue.flows;
3023	qspec.flowqueue.quantum = opts->flowqueue.quantum;
3024	qspec.flowqueue.interval = opts->flowqueue.interval;
3025	qspec.flowqueue.target = opts->flowqueue.target;
3026
3027	qspec.flags = opts->flags;
3028	qspec.qlimit = opts->qlimit;
3029
3030	if (pfctl_add_queue(pf, &qspec)) {
3031	yyerror("cannot add queue");
3032	return (1);
3033	}
3034	);
3035
3036	FREE_LIST(struct node_if, interfaces);
3037	return (0);
3038	}
3039
3040	int
3041	expand_divertspec(struct pf_rule r, struct divertspec ds)
3042	{
3043	struct node_host *n;
3044
3045	switch (ds->type) {
3046	case PF_DIVERT_NONE:
3047	return (0);
3048	case PF_DIVERT_TO:
3049	if (r->direction == PF_OUT) {
3050	yyerror("divert-to used with outgoing rule");
3051	return (1);
3052	}
3053	if (r->af) {
3054	for (n = ds->addr; n != NULL((void *)0); n = n->next)
3055	if (n->af == r->af)
3056	break;
3057	if (n == NULL((void *)0)) {
3058	yyerror("divert-to address family mismatch");
3059	return (1);
3060	}
3061	r->divert.addr = n->addr.v.a.addr;
3062	} else {
3063	r->af = ds->addr->af;
3064	r->divert.addr = ds->addr->addr.v.a.addr;
3065	}
3066	r->divert.port = ds->port;
3067	r->divert.type = ds->type;
3068	return (0);
3069	case PF_DIVERT_REPLY:
3070	if (r->direction == PF_IN) {
3071	yyerror("divert-reply used with incoming rule");
3072	return (1);
3073	}
3074	r->divert.type = ds->type;
3075	return (0);
3076	case PF_DIVERT_PACKET:
3077	r->divert.port = ds->port;
3078	r->divert.type = ds->type;
3079	return (0);
3080	}
3081	return (1);
3082	}
3083
3084	int
3085	collapse_redirspec(struct pf_pool rpool, struct pf_rule r,
3086	struct redirspec *rs, int routing)
3087	{
3088	struct pf_opt_tbl tbl = NULL((void )0);
3089	struct node_host h, hprev = NULL((void *)0);
3090	struct pf_rule_addr ra;
3091	int af = 0, naddr = 0;
3092
3093	if (!rs \|\| !rs->rdr \|\| rs->rdr->host == NULL((void *)0)) {
3094	rpool->addr.type = PF_ADDR_NONE;
3095	return (0);
3096	}
3097
3098	if (r->rule_flag & PFRULE_AFTO0x00200000)
3099	r->naf = rs->af;
3100
3101	for (h = rs->rdr->host; h != NULL((void *)0); h = h->next) {
3102	if (routing) {
3103	if (h->addr.type == PF_ADDR_DYNIFTL &&
3104	h->addr.iflags != PFI_AFLAG_PEER0x04) {
3105	yyerror("route spec requires :peer with "
3106	"dynamic interface addresses");
3107	return (1);
3108	}
3109	}
3110
3111	/* set rule address family if redirect spec has one */
3112	if (rs->af && !r->af && !af) {
3113	/* swap address families for af-to */
3114	if (r->naf == AF_INET624)
3115	af = AF_INET2;
3116	else if (r->naf == AF_INET2)
3117	af = AF_INET624;
3118	else
3119	af = rs->af;
3120	}
3121	if (h->af && !r->naf) { /* nat-to/rdr-to case */
3122	/* skip if the rule af doesn't match redirect af */
3123	if (r->af && r->af != h->af)
3124	continue;
3125	/*
3126	* fail if the chosen af is not universal for
3127	* all addresses in the redirect address pool
3128	*/
3129	if (!r->af && af && af != h->af) {
3130	yyerror("%s spec contains addresses with "
3131	"different address families",
3132	routing ? "routing" : "translation");
3133	return (1);
3134	}
3135	} else if (h->af) { /* af-to case */
3136	/*
3137	* fail if the redirect spec af is not universal
3138	* for all addresses in the redirect address pool
3139	*/
3140	if (rs->af && rs->af != h->af) {
3141	yyerror("%s spec contains addresses that "
3142	"don't match target address family",
3143	routing ? "routing" : "translation");
3144	return (1);
3145	}
3146	}
3147	/* else if (!h->af):
3148	* we silently allow any not af-specific host specs,
3149	* e.g. (em0) and let the kernel deal with them
3150	*/
3151
3152	/* if we haven't selected the rule af yet, now it's time */
3153	if (!r->af && !af)
3154	af = h->af;
3155
3156	if (naddr == 0) { /* the first host */
3157	rpool->addr = h->addr;
3158	if (h->ifname) {
3159	yyerror("@if not permitted for %s",
3160	routing ? "routing" : "translation");
3161	return (1);
3162	}
3163	if (h->ifname && strlcpy(rpool->ifname, h->ifname,
3164	sizeof(rpool->ifname)) >= sizeof(rpool->ifname))
3165	errx(1, "collapse_redirspec: strlcpy");
3166	hprev = h; /* in case we need to conver to a table */
3167	} else { /* multiple hosts */
3168	if (rs->pool_opts.type &&
3169	!PF_POOL_DYNTYPE(rs->pool_opts.type)((((rs->pool_opts.type) & 0x0f) == PF_POOL_ROUNDROBIN) \|\| (((rs->pool_opts.type) & 0x0f) == PF_POOL_LEASTSTATES ) \|\| (((rs->pool_opts.type) & 0x0f) == PF_POOL_RANDOM) \|\| (((rs->pool_opts.type) & 0x0f) == PF_POOL_SRCHASH) )) {
3170	yyerror("pool type is not valid for multiple "
3171	"translation or routing addresses");
3172	return (1);
3173	}
3174	if ((hprev && hprev->addr.type != PF_ADDR_ADDRMASK) &&
3175	(hprev && hprev->addr.type != PF_ADDR_NONE) &&
3176	h->addr.type != PF_ADDR_ADDRMASK &&
3177	h->addr.type != PF_ADDR_NONE) {
3178	yyerror("multiple tables or dynamic interfaces "
3179	"not supported for translation or routing");
3180	return (1);
3181	}
3182	if (h->ifname) {
3183	yyerror("@if not permitted for %s",
3184	routing ? "routing" : "translation");
3185	return (1);
3186	}
3187	if (hprev) {
3188	/*
3189	* undo some damage and convert the single
3190	* host pool to the table
3191	*/
3192	memset(&ra, 0, sizeof(ra));
3193	memset(rpool->ifname, 0, sizeof(rpool->ifname));
3194	ra.addr = hprev->addr;
3195	ra.weight = hprev->weight;
3196	if (add_opt_table(pf, &tbl,
3197	hprev->af, &ra, hprev->ifname))
3198	return (1);
3199	hprev = NULL((void *)0);
3200	}
3201	memset(&ra, 0, sizeof(ra));
3202	ra.addr = h->addr;
3203	ra.weight = h->weight;
3204	if (add_opt_table(pf, &tbl,
3205	h->af, &ra, h->ifname))
3206	return (1);
3207	}
3208	naddr++;
3209	}
3210	/* set rule af to the one chosen above */
3211	if (!r->af && af)
3212	r->af = af;
3213	if (!naddr) {
3214	yyerror("af mismatch in %s spec",
3215	routing ? "routing" : "translation");
3216	return (1);
3217	}
3218	if (tbl) {
3219	if ((pf->opts & PF_OPT_NOACTION0x00008) == 0 &&
3220	pf_opt_create_table(pf, tbl))
3221	return (1);
3222
3223	pf->tdirty = 1;
3224
3225	if (pf->opts & PF_OPT_VERBOSE0x00004)
3226	print_tabledef(tbl->pt_name,
3227	PFR_TFLAG_CONST0x00000002 \| tbl->pt_flags,
3228	1, &tbl->pt_nodes);
3229
3230	memset(&rpool->addr, 0, sizeof(rpool->addr));
3231	rpool->addr.type = PF_ADDR_TABLE;
3232	strlcpy(rpool->addr.v.tblname, tbl->pt_name,
3233	sizeof(rpool->addr.v.tblname));
3234
3235	pfr_buf_clear(tbl->pt_buf);
3236	free(tbl->pt_buf);
3237	tbl->pt_buf = NULL((void *)0);
3238	free(tbl);
3239	}
3240	return (0);
3241	}
3242
3243
3244	int
3245	apply_redirspec(struct pf_pool rpool, struct pf_rule r, struct redirspec *rs,
3246	int isrdr, struct node_port *np)
3247	{
3248	if (!rs \|\| !rs->rdr)
3249	return (0);
3250
3251	rpool->proxy_port[0] = ntohs(rs->rdr->rport.a)(__uint16_t)(__builtin_constant_p(rs->rdr->rport.a) ? ( __uint16_t)(((__uint16_t)(rs->rdr->rport.a) & 0xffU ) << 8 \| ((__uint16_t)(rs->rdr->rport.a) & 0xff00U ) >> 8) : __swap16md(rs->rdr->rport.a));
3252
3253	if (isrdr) {
3254	if (!rs->rdr->rport.b && rs->rdr->rport.t) {
3255	rpool->proxy_port[1] = ntohs(rs->rdr->rport.a)(__uint16_t)(__builtin_constant_p(rs->rdr->rport.a) ? ( __uint16_t)(((__uint16_t)(rs->rdr->rport.a) & 0xffU ) << 8 \| ((__uint16_t)(rs->rdr->rport.a) & 0xff00U ) >> 8) : __swap16md(rs->rdr->rport.a)) +
3256	(ntohs(np->port[1])(__uint16_t)(__builtin_constant_p(np->port[1]) ? (__uint16_t )(((__uint16_t)(np->port[1]) & 0xffU) << 8 \| ((__uint16_t )(np->port[1]) & 0xff00U) >> 8) : __swap16md(np-> port[1])) - ntohs(np->port[0])(__uint16_t)(__builtin_constant_p(np->port[0]) ? (__uint16_t )(((__uint16_t)(np->port[0]) & 0xffU) << 8 \| ((__uint16_t )(np->port[0]) & 0xff00U) >> 8) : __swap16md(np-> port[0])));
3257	} else {
3258	if (validate_range(rs->rdr->rport.t, rs->rdr->rport.a,
3259	rs->rdr->rport.b)) {
3260	yyerror("invalid rdr-to port range");
3261	return (1);
3262	}
3263
3264	rpool->port_op = rs->rdr->rport.t;
3265	rpool->proxy_port[1] = ntohs(rs->rdr->rport.b)(__uint16_t)(__builtin_constant_p(rs->rdr->rport.b) ? ( __uint16_t)(((__uint16_t)(rs->rdr->rport.b) & 0xffU ) << 8 \| ((__uint16_t)(rs->rdr->rport.b) & 0xff00U ) >> 8) : __swap16md(rs->rdr->rport.b));
3266	}
3267	} else {
3268	rpool->proxy_port[1] = ntohs(rs->rdr->rport.b)(__uint16_t)(__builtin_constant_p(rs->rdr->rport.b) ? ( __uint16_t)(((__uint16_t)(rs->rdr->rport.b) & 0xffU ) << 8 \| ((__uint16_t)(rs->rdr->rport.b) & 0xff00U ) >> 8) : __swap16md(rs->rdr->rport.b));
3269	if (!rpool->proxy_port[0] && !rpool->proxy_port[1]) {
3270	rpool->proxy_port[0] = PF_NAT_PROXY_PORT_LOW50001;
3271	rpool->proxy_port[1] = PF_NAT_PROXY_PORT_HIGH65535;
3272	} else if (!rpool->proxy_port[1])
3273	rpool->proxy_port[1] = rpool->proxy_port[0];
3274	}
3275
3276	rpool->opts = rs->pool_opts.type;
3277	if ((rpool->opts & PF_POOL_TYPEMASK0x0f) == PF_POOL_NONE &&
3278	(rpool->addr.type == PF_ADDR_TABLE \|\|
3279	DYNIF_MULTIADDR(rpool->addr)((rpool->addr).type == PF_ADDR_DYNIFTL && (!((rpool ->addr).iflags & 0x08) \|\| !isdigit((unsigned char)(rpool ->addr).v.ifname[strlen((rpool->addr).v.ifname)-1])))))
3280	rpool->opts \|= PF_POOL_ROUNDROBIN;
3281
3282	if (!PF_POOL_DYNTYPE(rpool->opts)((((rpool->opts) & 0x0f) == PF_POOL_ROUNDROBIN) \|\| ((( rpool->opts) & 0x0f) == PF_POOL_LEASTSTATES) \|\| (((rpool ->opts) & 0x0f) == PF_POOL_RANDOM) \|\| (((rpool->opts ) & 0x0f) == PF_POOL_SRCHASH)) &&
3283	(disallow_table(rs->rdr->host,
3284	"tables are not supported by pool type") \|\|
3285	disallow_alias(rs->rdr->host,
3286	"interface (%s) is not supported by pool type")))
3287	return (1);
3288
3289	if (rs->pool_opts.key != NULL((void *)0))
3290	memcpy(&rpool->key, rs->pool_opts.key,
3291	sizeof(struct pf_poolhashkey));
3292
3293	if (rs->pool_opts.opts)
3294	rpool->opts \|= rs->pool_opts.opts;
3295
3296	if (rs->pool_opts.staticport) {
3297	if (isrdr) {
3298	yyerror("the 'static-port' option is only valid with "
3299	"nat rules");
3300	return (1);
3301	}
3302	if (rpool->proxy_port[0] != PF_NAT_PROXY_PORT_LOW50001 &&
3303	rpool->proxy_port[1] != PF_NAT_PROXY_PORT_HIGH65535) {
3304	yyerror("the 'static-port' option can't be used when "
3305	"specifying a port range");
3306	return (1);
3307	}
3308	rpool->proxy_port[0] = 0;
3309	rpool->proxy_port[1] = 0;
3310	}
3311
3312	return (0);
3313	}
3314
3315
3316	void
3317	expand_rule(struct pf_rule r, int keeprule, struct node_if interfaces,
3318	struct redirspec nat, struct redirspec rdr, struct redirspec *rroute,
3319	struct node_proto protos, struct node_os src_oses,
3320	struct node_host src_hosts, struct node_port src_ports,
3321	struct node_host dst_hosts, struct node_port dst_ports,
3322	struct node_uid uids, struct node_gid gids, struct node_if *rcv,
3323	struct node_icmp *icmp_types)
3324	{
3325	sa_family_t af = r->af;
3326	int added = 0, error = 0;
3327	char ifname[IF_NAMESIZE16];
3328	char label[PF_RULE_LABEL_SIZE64];
3329	char tagname[PF_TAG_NAME_SIZE64];
3330	char match_tagname[PF_TAG_NAME_SIZE64];
3331	u_int8_t flags, flagset, keep_state;
3332	struct node_host srch, dsth, osrch, odsth;
3333	struct redirspec binat;
3334	struct pf_rule rb;
3335	int dir = r->direction;
3336
3337	if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label))
3338	errx(1, "expand_rule: strlcpy");
3339	if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname))
3340	errx(1, "expand_rule: strlcpy");
3341	if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >=
3342	sizeof(match_tagname))
3343	errx(1, "expand_rule: strlcpy");
3344	flags = r->flags;
3345	flagset = r->flagset;
3346	keep_state = r->keep_state;
3347
3348	r->src.addr.type = r->dst.addr.type = PF_ADDR_ADDRMASK;
3349
3350	LOOP_THROUGH(struct node_if, interface, interfaces,
3351	LOOP_THROUGH(struct node_proto, proto, protos,
3352	LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types,
3353	LOOP_THROUGH(struct node_host, src_host, src_hosts,
3354	LOOP_THROUGH(struct node_host, dst_host, dst_hosts,
3355	LOOP_THROUGH(struct node_port, src_port, src_ports,
3356	LOOP_THROUGH(struct node_port, dst_port, dst_ports,
3357	LOOP_THROUGH(struct node_os, src_os, src_oses,
3358	LOOP_THROUGH(struct node_uid, uid, uids,
3359	LOOP_THROUGH(struct node_gid, gid, gids,
3360
3361	r->af = af;
3362
3363	error += collapse_redirspec(&r->rdr, r, rdr, 0);
3364	error += collapse_redirspec(&r->nat, r, nat, 0);
3365	error += collapse_redirspec(&r->route, r, rroute, 1);
3366
3367	/* disallow @if in from or to for the time being */
3368	if ((src_host->addr.type == PF_ADDR_ADDRMASK &&
3369	src_host->ifname) \|\|
3370	(dst_host->addr.type == PF_ADDR_ADDRMASK &&
3371	dst_host->ifname)) {
3372	yyerror("@if syntax not permitted in from or to");
3373	error++;
3374	}
3375	/* for link-local IPv6 address, interface must match up */
3376	if ((r->af && src_host->af && r->af != src_host->af) \|\|
3377	(r->af && dst_host->af && r->af != dst_host->af) \|\|
3378	(src_host->af && dst_host->af &&
3379	src_host->af != dst_host->af) \|\|
3380	(src_host->ifindex && dst_host->ifindex &&
3381	src_host->ifindex != dst_host->ifindex) \|\|
3382	(src_host->ifindex && *interface->ifname &&
3383	src_host->ifindex != ifa_nametoindex(interface->ifname)) \|\|
3384	(dst_host->ifindex && *interface->ifname &&
3385	dst_host->ifindex != ifa_nametoindex(interface->ifname)))
3386	continue;
3387	if (!r->af && src_host->af)
3388	r->af = src_host->af;
3389	else if (!r->af && dst_host->af)
3390	r->af = dst_host->af;
3391
3392	if (*interface->ifname)
3393	strlcpy(r->ifname, interface->ifname,
3394	sizeof(r->ifname));
3395	else if (ifa_indextoname(src_host->ifindex, ifname))
3396	strlcpy(r->ifname, ifname, sizeof(r->ifname));
3397	else if (ifa_indextoname(dst_host->ifindex, ifname))
3398	strlcpy(r->ifname, ifname, sizeof(r->ifname));
3399	else
3400	memset(r->ifname, '\0', sizeof(r->ifname));
3401
3402	if (interface->use_rdomain)
3403	r->onrdomain = interface->rdomain;
3404	else
3405	r->onrdomain = -1;
3406	if (strlcpy(r->label, label, sizeof(r->label)) >=
3407	sizeof(r->label))
3408	errx(1, "expand_rule: strlcpy");
3409	if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >=
3410	sizeof(r->tagname))
3411	errx(1, "expand_rule: strlcpy");
3412	if (strlcpy(r->match_tagname, match_tagname,
3413	sizeof(r->match_tagname)) >= sizeof(r->match_tagname))
3414	errx(1, "expand_rule: strlcpy");
3415	expand_label(r->label, PF_RULE_LABEL_SIZE64, r->ifname, r->af,
3416	src_host, src_port, dst_host, dst_port, proto->proto);
3417	expand_label(r->tagname, PF_TAG_NAME_SIZE64, r->ifname, r->af,
3418	src_host, src_port, dst_host, dst_port, proto->proto);
3419	expand_label(r->match_tagname, PF_TAG_NAME_SIZE64, r->ifname,
3420	r->af, src_host, src_port, dst_host, dst_port,
3421	proto->proto);
3422
3423	osrch = odsth = NULL((void *)0);
3424	if (src_host->addr.type == PF_ADDR_DYNIFTL) {
3425	osrch = src_host;
3426	if ((src_host = gen_dynnode(src_host, r->af)) == NULL((void *)0))
3427	err(1, "%s", __func__);
3428	}
3429	if (dst_host->addr.type == PF_ADDR_DYNIFTL) {
3430	odsth = dst_host;
3431	if ((dst_host = gen_dynnode(dst_host, r->af)) == NULL((void *)0))
3432	err(1, "%s", __func__);
3433	}
3434
3435	error += check_netmask(src_host, r->af);
3436	error += check_netmask(dst_host, r->af);
3437
3438	r->ifnot = interface->not;
3439	r->proto = proto->proto;
3440	r->src.addr = src_host->addr;
3441	r->src.neg = src_host->not;
3442	r->src.port[0] = src_port->port[0];
3443	r->src.port[1] = src_port->port[1];
3444	r->src.port_op = src_port->op;
3445	r->dst.addr = dst_host->addr;
3446	r->dst.neg = dst_host->not;
3447	r->dst.port[0] = dst_port->port[0];
3448	r->dst.port[1] = dst_port->port[1];
3449	r->dst.port_op = dst_port->op;
3450	r->uid.op = uid->op;
3451	r->uid.uid[0] = uid->uid[0];
3452	r->uid.uid[1] = uid->uid[1];
3453	r->gid.op = gid->op;
3454	r->gid.gid[0] = gid->gid[0];
3455	r->gid.gid[1] = gid->gid[1];
3456	if (rcv) {
3457	strlcpy(r->rcv_ifname, rcv->ifname,
3458	sizeof(r->rcv_ifname));
3459	r->rcvifnot = rcv->not;
3460	}
3461	r->type = icmp_type->type;
3462	r->code = icmp_type->code;
3463
3464	if ((keep_state == PF_STATE_MODULATE0x2 \|\|
3465	keep_state == PF_STATE_SYNPROXY0x3) &&
3466	r->proto && r->proto != IPPROTO_TCP6)
3467	r->keep_state = PF_STATE_NORMAL0x1;
3468	else
3469	r->keep_state = keep_state;
3470
3471	if (r->proto && r->proto != IPPROTO_TCP6) {
3472	r->flags = 0;
3473	r->flagset = 0;
3474	} else {
3475	r->flags = flags;
3476	r->flagset = flagset;
3477	}
3478	if (icmp_type->proto && r->proto != icmp_type->proto) {
3479	yyerror("icmp-type mismatch");
3480	error++;
3481	}
3482
3483	if (src_os && src_os->os) {
3484	r->os_fingerprint = pfctl_get_fingerprint(src_os->os);
3485	if ((pf->opts & PF_OPT_VERBOSE20x00080) &&
3486	r->os_fingerprint == PF_OSFP_NOMATCH((pf_osfp_t)-2))
3487	fprintf(stderr(&__sF[2]),
3488	"warning: unknown '%s' OS fingerprint\n",
3489	src_os->os);
3490	} else {
3491	r->os_fingerprint = PF_OSFP_ANY((pf_osfp_t)0);
3492	}
3493
3494	if (nat && nat->rdr && nat->binat) {
3495	if (disallow_table(src_host, "invalid use of table "
3496	"<%s> as the source address of a binat-to rule") \|\|
3497	disallow_alias(src_host, "invalid use of interface "
3498	"(%s) as the source address of a binat-to rule")) {
3499	error++;
3500	} else if ((r->src.addr.type != PF_ADDR_ADDRMASK &&
3501	r->src.addr.type != PF_ADDR_DYNIFTL) \|\|
3502	(r->nat.addr.type != PF_ADDR_ADDRMASK &&
3503	r->nat.addr.type != PF_ADDR_DYNIFTL)) {
3504	yyerror("binat-to requires a specified "
3505	"source and redirect address");
3506	error++;
3507	}
3508	if (DYNIF_MULTIADDR(r->src.addr)((r->src.addr).type == PF_ADDR_DYNIFTL && (!((r-> src.addr).iflags & 0x08) \|\| !isdigit((unsigned char)(r-> src.addr).v.ifname[strlen((r->src.addr).v.ifname)-1]))) \|\|
3509	DYNIF_MULTIADDR(r->nat.addr)((r->nat.addr).type == PF_ADDR_DYNIFTL && (!((r-> nat.addr).iflags & 0x08) \|\| !isdigit((unsigned char)(r-> nat.addr).v.ifname[strlen((r->nat.addr).v.ifname)-1])))) {
3510	yyerror ("dynamic interfaces must be used with "
3511	":0 in a binat-to rule");
3512	error++;
3513	}
3514	if (PF_AZERO(&r->src.addr.v.a.mask, af)((af == 2 && !(&r->src.addr.v.a.mask)->pfa. addr32[0]) \|\| (af == 24 && !(&r->src.addr.v.a. mask)->pfa.addr32[0] && !(&r->src.addr.v.a. mask)->pfa.addr32[1] && !(&r->src.addr.v.a. mask)->pfa.addr32[2] && !(&r->src.addr.v.a. mask)->pfa.addr32[3] )) \|\|
3515	PF_AZERO(&r->nat.addr.v.a.mask, af)((af == 2 && !(&r->nat.addr.v.a.mask)->pfa. addr32[0]) \|\| (af == 24 && !(&r->nat.addr.v.a. mask)->pfa.addr32[0] && !(&r->nat.addr.v.a. mask)->pfa.addr32[1] && !(&r->nat.addr.v.a. mask)->pfa.addr32[2] && !(&r->nat.addr.v.a. mask)->pfa.addr32[3] ))) {
3516	yyerror ("source and redir addresess must have "
3517	"a matching network mask in binat-rule");
3518	error++;
3519	}
3520	if (r->nat.addr.type == PF_ADDR_TABLE) {
3521	yyerror ("tables cannot be used as the redirect "
3522	"address of a binat-to rule");
3523	error++;
3524	}
3525	if (r->direction != PF_INOUT) {
3526	yyerror("binat-to cannot be specified "
3527	"with a direction");
3528	error++;
3529	}
3530
3531	/* first specify outbound NAT rule */
3532	r->direction = PF_OUT;
3533	}
3534
3535	error += apply_redirspec(&r->nat, r, nat, 0, dst_port);
3536	error += apply_redirspec(&r->rdr, r, rdr, 1, dst_port);
3537	error += apply_redirspec(&r->route, r, rroute, 2, dst_port);
3538
3539	if (rule_consistent(r) < 0 \|\| error)
3540	yyerror("skipping rule due to errors");
3541	else {
3542	r->nr = pf->astack[pf->asd]->match++;
3543	pfctl_add_rule(pf, r);
3544	added++;
3545	}
3546	r->direction = dir;
3547
3548	/* Generate binat's matching inbound rule */
3549	if (!error && nat && nat->rdr && nat->binat) {
3550	bcopy(r, &rb, sizeof(rb));
3551
3552	/* now specify inbound rdr rule */
3553	rb.direction = PF_IN;
3554
3555	if ((srch = calloc(1, sizeof(srch))) == NULL((void )0))
3556	err(1, "%s", __func__);
3557	bcopy(src_host, srch, sizeof(*srch));
3558	srch->ifname = NULL((void *)0);
3559	srch->next = NULL((void *)0);
3560	srch->tail = NULL((void *)0);
3561
3562	if ((dsth = calloc(1, sizeof(dsth))) == NULL((void )0))
3563	err(1, "%s", __func__);
3564	bcopy(&rb.nat.addr, &dsth->addr, sizeof(dsth->addr));
3565	dsth->ifname = NULL((void *)0);
3566	dsth->next = NULL((void *)0);
3567	dsth->tail = NULL((void *)0);
3568
3569	bzero(&binat, sizeof(binat));
3570	if ((binat.rdr =
3571	calloc(1, sizeof(binat.rdr))) == NULL((void )0))
3572	err(1, "%s", __func__);
3573	bcopy(nat->rdr, binat.rdr, sizeof(*binat.rdr));
3574	bcopy(&nat->pool_opts, &binat.pool_opts,
3575	sizeof(binat.pool_opts));
3576	binat.pool_opts.staticport = 0;
3577	binat.rdr->host = srch;
3578
3579	expand_rule(&rb, 1, interface, NULL((void )0), &binat, NULL((void )0),
3580	proto,
3581	src_os, dst_host, dst_port, dsth, src_port,
3582	uid, gid, rcv, icmp_type);
3583	}
3584
3585	if (osrch && src_host->addr.type == PF_ADDR_DYNIFTL) {
3586	free(src_host);
3587	src_host = osrch;
3588	}
3589	if (odsth && dst_host->addr.type == PF_ADDR_DYNIFTL) {
3590	free(dst_host);
3591	dst_host = odsth;
3592	}
3593	))))))))));
3594
3595	if (!keeprule) {
3596	FREE_LIST(struct node_if, interfaces);
3597	FREE_LIST(struct node_proto, protos);
3598	FREE_LIST(struct node_host, src_hosts);
3599	FREE_LIST(struct node_port, src_ports);
3600	FREE_LIST(struct node_os, src_oses);
3601	FREE_LIST(struct node_host, dst_hosts);
3602	FREE_LIST(struct node_port, dst_ports);
3603	FREE_LIST(struct node_uid, uids);
3604	FREE_LIST(struct node_gid, gids);
3605	FREE_LIST(struct node_icmp, icmp_types);
3606	if (nat && nat->rdr)
3607	FREE_LIST(struct node_host, nat->rdr->host);
3608	if (rdr && rdr->rdr)
3609	FREE_LIST(struct node_host, rdr->rdr->host);
3610
3611	}
3612
3613	if (!added)
3614	yyerror("rule expands to no valid combination");
3615	}
3616
3617	int
3618	expand_skip_interface(struct node_if *interfaces)
3619	{
3620	int errs = 0;
3621
3622	if (!interfaces \|\| (!interfaces->next && !interfaces->not &&
3623	!strcmp(interfaces->ifname, "none"))) {
3624	if (pf->opts & PF_OPT_VERBOSE0x00004)
3625	printf("set skip on none\n");
3626	errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP0x0100, 0);
3627	return (errs);
3628	}
3629
3630	if (pf->opts & PF_OPT_VERBOSE0x00004)
3631	printf("set skip on {");
3632	LOOP_THROUGH(struct node_if, interface, interfaces,
3633	if (pf->opts & PF_OPT_VERBOSE0x00004)
3634	printf(" %s", interface->ifname);
3635	if (interface->not) {
3636	yyerror("skip on ! <interface> is not supported");
3637	errs++;
3638	} else if (interface->use_rdomain) {
3639	yyerror("skip on rdomain <num> is not supported");
3640	errs++;
3641	} else
3642	errs += pfctl_set_interface_flags(pf,
3643	interface->ifname, PFI_IFLAG_SKIP0x0100, 1);
3644	);
3645	if (pf->opts & PF_OPT_VERBOSE0x00004)
3646	printf(" }\n");
3647
3648	FREE_LIST(struct node_if, interfaces);
3649
3650	if (errs)
3651	return (1);
3652	else
3653	return (0);
3654	}
3655
3656	void
3657	freehostlist(struct node_host *h)
3658	{
3659	struct node_host *n;
3660
3661	for (n = h; n != NULL((void *)0); n = n->next)
3662	if (n->ifname)
3663	free(n->ifname);
3664	FREE_LIST(struct node_host, h);
3665	}
3666
3667	#undef FREE_LIST
3668	#undef LOOP_THROUGH
3669
3670	int
3671	kw_cmp(const void k, const void e)
3672	{
3673	return (strcmp(k, ((const struct keywords *)e)->k_name));
3674	}
3675
3676	int
3677	lookup(char *s)
3678	{
3679	/* this has to be sorted always */
3680	static const struct keywords keywords[] = {
3681	{ "af-to", AFTO377},
3682	{ "all", ALL277},
3683	{ "allow-opts", ALLOWOPTS290},
3684	{ "anchor", ANCHOR309},
3685	{ "antispoof", ANTISPOOF324},
3686	{ "any", ANY278},
3687	{ "bandwidth", BANDWIDTH336},
3688	{ "binat-to", BINATTO286},
3689	{ "bitmask", BITMASK328},
3690	{ "block", BLOCK258},
3691	{ "block-policy", BLOCKPOLICY316},
3692	{ "burst", BURST345},
3693	{ "code", CODE281},
3694	{ "debug", DEBUG321},
3695	{ "default", DEFAULT351},
3696	{ "delay", DELAY352},
3697	{ "divert-packet", DIVERTPACKET375},
3698	{ "divert-reply", DIVERTREPLY374},
3699	{ "divert-to", DIVERTTO373},
3700	{ "drop", DROP306},
3701	{ "dup-to", DUPTO293},
3702	{ "file", FILENAME291},
3703	{ "fingerprints", FINGERPRINTS319},
3704	{ "flags", FLAGS270},
3705	{ "floating", FLOATING369},
3706	{ "flows", FLOWS337},
3707	{ "flush", FLUSH362},
3708	{ "for", FOR325},
3709	{ "fragment", FRAGMENT299},
3710	{ "from", FROM268},
3711	{ "global", GLOBAL357},
3712	{ "group", GROUP301},
3713	{ "hostid", HOSTID323},
3714	{ "icmp-type", ICMPTYPE279},
3715	{ "icmp6-type", ICMP6TYPE280},
3716	{ "if-bound", IFBOUND368},
3717	{ "in", IN262},
3718	{ "include", INCLUDE326},
3719	{ "inet", INET275},
3720	{ "inet6", INET6276},
3721	{ "keep", KEEP282},
3722	{ "label", LABEL296},
3723	{ "least-states", LEASTSTATES332},
3724	{ "limit", LIMIT314},
3725	{ "load", LOAD347},
3726	{ "log", LOG265},
3727	{ "loginterface", LOGINTERFACE315},
3728	{ "match", MATCH259},
3729	{ "matches", MATCHES327},
3730	{ "max", MAXIMUM303},
3731	{ "max-mss", MAXMSS302},
3732	{ "max-pkt-rate", MAXPKTRATE365},
3733	{ "max-src-conn", MAXSRCCONN359},
3734	{ "max-src-conn-rate", MAXSRCCONNRATE360},
3735	{ "max-src-nodes", MAXSRCNODES355},
3736	{ "max-src-states", MAXSRCSTATES354},
3737	{ "min", MINIMUM344},
3738	{ "min-ttl", MINTTL288},
3739	{ "modulate", MODULATE283},
3740	{ "nat-to", NATTO376},
3741	{ "no", NO295},
3742	{ "no-df", NODF287},
3743	{ "no-route", NOROUTE297},
3744	{ "no-sync", NOSYNC320},
3745	{ "on", ON267},
3746	{ "once", ONCE350},
3747	{ "optimization", OPTIMIZATION312},
3748	{ "os", OS263},
3749	{ "out", OUT264},
3750	{ "overload", OVERLOAD361},
3751	{ "parent", PARENT346},
3752	{ "pass", PASS257},
3753	{ "pflow", PFLOW364},
3754	{ "port", PORT285},
3755	{ "prio", PRIO349},
3756	{ "probability", PROBABILITY334},
3757	{ "proto", PROTO274},
3758	{ "qlimit", QLIMIT341},
3759	{ "quantum", QUANTUM338},
3760	{ "queue", QUEUE339},
3761	{ "quick", QUICK266},
3762	{ "random", RANDOM329},
3763	{ "random-id", RANDOMID317},
3764	{ "rdomain", RDOMAIN343},
3765	{ "rdr-to", RDRTO378},
3766	{ "reassemble", REASSEMBLE308},
3767	{ "received-on", RECEIVEDON379},
3768	{ "reply-to", REPLYTO294},
3769	{ "return", RETURN261},
3770	{ "return-icmp", RETURNICMP272},
3771	{ "return-icmp6", RETURNICMP6273},
3772	{ "return-rst", RETURNRST271},
3773	{ "round-robin", ROUNDROBIN331},
3774	{ "route", ROUTE372},
3775	{ "route-to", ROUTETO292},
3776	{ "rtable", RTABLE342},
3777	{ "rule", RULE358},
3778	{ "ruleset-optimization", RULESET_OPTIMIZATION348},
3779	{ "scrub", SCRUB260},
3780	{ "set", SET311},
3781	{ "skip", SKIP322},
3782	{ "sloppy", SLOPPY363},
3783	{ "source-hash", SOURCEHASH330},
3784	{ "source-track", SOURCETRACK356},
3785	{ "state", STATE284},
3786	{ "state-defaults", STATEDEFAULTS371},
3787	{ "state-policy", STATEPOLICY370},
3788	{ "static-port", STATICPORT333},
3789	{ "sticky-address", STICKYADDRESS353},
3790	{ "syncookies", SYNCOOKIES310},
3791	{ "synproxy", SYNPROXY318},
3792	{ "table", TABLE307},
3793	{ "tag", TAG367},
3794	{ "tagged", TAGGED366},
3795	{ "timeout", TIMEOUT313},
3796	{ "to", TO269},
3797	{ "tos", TOS305},
3798	{ "ttl", TTL304},
3799	{ "urpf-failed", URPFFAILED298},
3800	{ "user", USER300},
3801	{ "weight", WEIGHT335},
3802	};
3803	const struct keywords *p;
3804
3805	p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
3806	sizeof(keywords[0]), kw_cmp);
3807
3808	if (p) {
3809	if (debug > 1)
3810	fprintf(stderr(&__sF[2]), "%s: %d\n", s, p->k_val);
3811	return (p->k_val);
3812	} else {
3813	if (debug > 1)
3814	fprintf(stderr(&__sF[2]), "string: %s\n", s);
3815	return (STRING383);
3816	}
3817	}
3818
3819	#define START_EXPAND1 1
3820	#define DONE_EXPAND2 2
3821
3822	static int expanding;
3823
3824	int
3825	igetc(void)
3826	{
3827	int c;
3828	while (1) {
3829	if (file->ungetpos > 0)
3830	c = file->ungetbuf[--file->ungetpos];
3831	else
3832	c = getc(file->stream)(!__isthreaded ? (--(file->stream)->_r < 0 ? __srget (file->stream) : (int)(*(file->stream)->_p++)) : (getc )(file->stream));
3833	if (c == START_EXPAND1)
3834	expanding = 1;
3835	else if (c == DONE_EXPAND2)
3836	expanding = 0;
3837	else
3838	break;
3839	}
3840	return (c);
3841	}
3842
3843	int
3844	lgetc(int quotec)
3845	{
3846	int c, next;
3847
3848	if (quotec) {
3849	if ((c = igetc()) == EOF(-1)) {
3850	yyerror("reached end of file while parsing quoted string");
3851	if (file == topfile \|\| popfile() == EOF(-1))
3852	return (EOF(-1));
3853	return (quotec);
3854	}
3855	return (c);
3856	}
3857
3858	while ((c = igetc()) == '\\') {
3859	next = igetc();
3860	if (next != '\n') {
3861	c = next;
3862	break;
3863	}
3864	yylval.lineno = file->lineno;
3865	file->lineno++;
3866	}
3867
3868	if (c == EOF(-1)) {
3869	/*
3870	* Fake EOL when hit EOF for the first time. This gets line
3871	* count right if last line in included file is syntactically
3872	* invalid and has no newline.
3873	*/
3874	if (file->eof_reached == 0) {
3875	file->eof_reached = 1;
3876	return ('\n');
3877	}
3878	while (c == EOF(-1)) {
3879	if (file == topfile \|\| popfile() == EOF(-1))
3880	return (EOF(-1));
3881	c = igetc();
3882	}
3883	}
3884
3885	return (c);
3886	}
3887
3888	void
3889	lungetc(int c)
3890	{
3891	if (c == EOF(-1))
3892	return;
3893	if (file->ungetpos >= file->ungetsize) {
3894	void *p = reallocarray(file->ungetbuf, file->ungetsize, 2);
3895	if (p == NULL((void *)0))
3896	err(1, "%s", __func__);
3897	file->ungetbuf = p;
3898	file->ungetsize *= 2;
3899	}
3900	file->ungetbuf[file->ungetpos++] = c;
3901	}
3902
3903	int
3904	findeol(void)
3905	{
3906	int c;
3907
3908	/* skip to either EOF or the first real EOL */
3909	while (1) {
3910	c = lgetc(0);
3911	if (c == '\n') {
3912	file->lineno++;
3913	break;
3914	}
3915	if (c == EOF(-1))
3916	break;
3917	}
3918	return (ERROR289);
3919	}
3920
3921	int
3922	yylex(void)
3923	{
3924	char buf[8096];
3925	char p, val;
3926	int quotec, next, c;
3927	int token;
3928
3929	top:
3930	p = buf;
3931	while ((c = lgetc(0)) == ' ' \|\| c == '\t')
3932	; /* nothing */
3933
3934	yylval.lineno = file->lineno;
3935	if (c == '#')
3936	while ((c = lgetc(0)) != '\n' && c != EOF(-1))
3937	; /* nothing */
3938	if (c == '$' && !expanding) {
3939	while (1) {
3940	if ((c = lgetc(0)) == EOF(-1))
3941	return (0);
3942
3943	if (p + 1 >= buf + sizeof(buf) - 1) {
3944	yyerror("string too long");
3945	return (findeol());
3946	}
3947	if (isalnum(c) \|\| c == '_') {
3948	*p++ = c;
3949	continue;
3950	}
3951	*p = '\0';
3952	lungetc(c);
3953	break;
3954	}
3955	val = symget(buf);
3956	if (val == NULL((void *)0)) {
3957	yyerror("macro '%s' not defined", buf);
3958	return (findeol());
3959	}
3960	p = val + strlen(val) - 1;
3961	lungetc(DONE_EXPAND2);
3962	while (p >= val) {
3963	lungetc((unsigned char)*p);
3964	p--;
3965	}
3966	lungetc(START_EXPAND1);
3967	goto top;
3968	}
3969
3970	switch (c) {
3971	case '\'':
3972	case '"':
3973	quotec = c;
3974	while (1) {
3975	if ((c = lgetc(quotec)) == EOF(-1))
3976	return (0);
3977	if (c == '\n') {
3978	file->lineno++;
3979	continue;
3980	} else if (c == '\\') {
3981	if ((next = lgetc(quotec)) == EOF(-1))
3982	return (0);
3983	if (next == quotec \|\| next == ' ' \|\|
3984	next == '\t')
3985	c = next;
3986	else if (next == '\n') {
3987	file->lineno++;
3988	continue;
3989	} else
3990	lungetc(next);
3991	} else if (c == quotec) {
3992	*p = '\0';
3993	break;
3994	} else if (c == '\0') {
3995	yyerror("syntax error");
3996	return (findeol());
3997	}
3998	if (p + 1 >= buf + sizeof(buf) - 1) {
3999	yyerror("string too long");
4000	return (findeol());
4001	}
4002	*p++ = c;
4003	}
4004	yylval.v.string = strdup(buf);
4005	if (yylval.v.string == NULL((void *)0))
4006	err(1, "%s", __func__);
4007	return (STRING383);
4008	case '!':
4009	next = lgetc(0);
4010	if (next == '=')
4011	return (NE380);
4012	lungetc(next);
4013	break;
4014	case '<':
4015	next = lgetc(0);
4016	if (next == '>') {
4017	yylval.v.i = PF_OP_XRG;
4018	return (PORTBINARY385);
4019	} else if (next == '=')
4020	return (LE381);
4021	lungetc(next);
4022	break;
4023	case '>':
4024	next = lgetc(0);
4025	if (next == '<') {
4026	yylval.v.i = PF_OP_IRG;
4027	return (PORTBINARY385);
4028	} else if (next == '=')
4029	return (GE382);
4030	lungetc(next);
4031	break;
4032	}
4033
4034	#define allowed_to_end_number(x)(isspace(x) \|\| x == ')' \|\| x ==',' \|\| x == '/' \|\| x == '}' \|\| x == '=') \
4035	(isspace(x) \|\| x == ')' \|\| x ==',' \|\| x == '/' \|\| x == '}' \|\| x == '=')
4036
4037	if (c == '-' \|\| isdigit(c)) {
4038	do {
4039	*p++ = c;
4040	if ((size_t)(p-buf) >= sizeof(buf)) {
4041	yyerror("string too long");
4042	return (findeol());
4043	}
4044	} while ((c = lgetc(0)) != EOF(-1) && isdigit(c));
4045	lungetc(c);
4046	if (p == buf + 1 && buf[0] == '-')
4047	goto nodigits;
4048	if (c == EOF(-1) \|\| allowed_to_end_number(c)(isspace(c) \|\| c == ')' \|\| c ==',' \|\| c == '/' \|\| c == '}' \|\| c == '=')) {
4049	const char errstr = NULL((void )0);
4050
4051	*p = '\0';
4052	yylval.v.number = strtonum(buf, LLONG_MIN(-0x7fffffffffffffffLL-1),
4053	LLONG_MAX0x7fffffffffffffffLL, &errstr);
4054	if (errstr) {
4055	yyerror("\"%s\" invalid number: %s",
4056	buf, errstr);
4057	return (findeol());
4058	}
4059	return (NUMBER384);
4060	} else {
4061	nodigits:
4062	while (p > buf + 1)
4063	lungetc((unsigned char)*--p);
4064	c = (unsigned char)*--p;
4065	if (c == '-')
4066	return (c);
4067	}
4068	}
4069
4070	#define allowed_in_string(x)(isalnum(x) \|\| (ispunct(x) && x != '(' && x != ')' && x != '{' && x != '}' && x != '<' && x != '>' && x != '!' && x != '=' && x != '/' && x != '#' && x != ',') ) \
4071	(isalnum(x) \|\| (ispunct(x) && x != '(' && x != ')' && \
4072	x != '{' && x != '}' && x != '<' && x != '>' && \
4073	x != '!' && x != '=' && x != '/' && x != '#' && \
4074	x != ','))
4075
4076	if (isalnum(c) \|\| c == ':' \|\| c == '_') {
4077	do {
4078	*p++ = c;
4079	if ((size_t)(p-buf) >= sizeof(buf)) {
4080	yyerror("string too long");
4081	return (findeol());
4082	}
4083	} while ((c = lgetc(0)) != EOF(-1) && (allowed_in_string(c)(isalnum(c) \|\| (ispunct(c) && c != '(' && c != ')' && c != '{' && c != '}' && c != '<' && c != '>' && c != '!' && c != '=' && c != '/' && c != '#' && c != ',') )));
4084	lungetc(c);
4085	*p = '\0';
4086	if ((token = lookup(buf)) == STRING383)
4087	if ((yylval.v.string = strdup(buf)) == NULL((void *)0))
4088	err(1, "%s", __func__);
4089	return (token);
4090	}
4091	if (c == '\n') {
4092	yylval.lineno = file->lineno;
4093	file->lineno++;
4094	}
4095	if (c == EOF(-1))
4096	return (0);
4097	return (c);
4098	}
4099
4100	int
4101	check_file_secrecy(int fd, const char *fname)
4102	{
4103	struct stat st;
4104
4105	if (fstat(fd, &st)) {
4106	warn("cannot stat %s", fname);
4107	return (-1);
4108	}
4109	if (st.st_uid != 0 && st.st_uid != getuid()) {
4110	warnx("%s: owner not root or current user", fname);
4111	return (-1);
4112	}
4113	if (st.st_mode & (S_IWGRP0000020 \| S_IXGRP0000010 \| S_IRWXO0000007)) {
4114	warnx("%s: group writable or world read/writable", fname);
4115	return (-1);
4116	}
4117	return (0);
4118	}
4119
4120	struct file *
4121	pushfile(const char *name, int secret)
4122	{
4123	struct file *nfile;
4124
4125	if ((nfile = calloc(1, sizeof(struct file))) == NULL((void *)0) \|\|
4126	(nfile->name = strdup(name)) == NULL((void *)0)) {
4127	warn("%s", __func__);
4128	if (nfile)
4129	free(nfile);
4130	return (NULL((void *)0));
4131	}
4132	if (TAILQ_FIRST(&files)((&files)->tqh_first) == NULL((void *)0) && strcmp(nfile->name, "-") == 0) {
4133	nfile->stream = stdin(&__sF[0]);
4134	free(nfile->name);
4135	if ((nfile->name = strdup("stdin")) == NULL((void *)0)) {
4136	warn("%s", __func__);
4137	free(nfile);
4138	return (NULL((void *)0));
4139	}
4140	} else if ((nfile->stream = pfctl_fopen(nfile->name, "r")) == NULL((void *)0)) {
4141	warn("%s: %s", __func__, nfile->name);
4142	free(nfile->name);
4143	free(nfile);
4144	return (NULL((void *)0));
4145	} else if (secret &&
4146	check_file_secrecy(fileno(nfile->stream)(!__isthreaded ? ((nfile->stream)->_file) : (fileno)(nfile ->stream)), nfile->name)) {
4147	fclose(nfile->stream);
4148	free(nfile->name);
4149	free(nfile);
4150	return (NULL((void *)0));
4151	}
4152	nfile->lineno = TAILQ_EMPTY(&files)(((&files)->tqh_first) == ((void *)0)) ? 1 : 0;
4153	nfile->ungetsize = 16;
4154	nfile->ungetbuf = malloc(nfile->ungetsize);
4155	if (nfile->ungetbuf == NULL((void *)0)) {
4156	warn("%s", __func__);
4157	fclose(nfile->stream);
4158	free(nfile->name);
4159	free(nfile);
4160	return (NULL((void *)0));
4161	}
4162	TAILQ_INSERT_TAIL(&files, nfile, entry)do { (nfile)->entry.tqe_next = ((void )0); (nfile)->entry .tqe_prev = (&files)->tqh_last; (&files)->tqh_last = (nfile); (&files)->tqh_last = &(nfile)->entry .tqe_next; } while (0);
4163	return (nfile);
4164	}
4165
4166	int
4167	popfile(void)
4168	{
4169	struct file *prev;
4170
4171	if ((prev = TAILQ_PREV(file, files, entry)((((struct files )((file)->entry.tqe_prev))->tqh_last ))) != NULL((void *)0))
4172	prev->errors += file->errors;
4173
4174	TAILQ_REMOVE(&files, file, entry)do { if (((file)->entry.tqe_next) != ((void )0)) (file)-> entry.tqe_next->entry.tqe_prev = (file)->entry.tqe_prev ; else (&files)->tqh_last = (file)->entry.tqe_prev; (file)->entry.tqe_prev = (file)->entry.tqe_next; ; ; } while (0);
4175	fclose(file->stream);
4176	free(file->name);
4177	free(file->ungetbuf);
4178	free(file);
4179	file = prev;
4180
4181	return (file ? 0 : EOF(-1));
4182	}
4183
4184	int
4185	parse_config(char filename, struct pfctl xpf)
4186	{
4187	int errors = 0;
4188	struct sym *sym;
4189
4190	pf = xpf;
4191	returnicmpdefault = (ICMP_UNREACH3 << 8) \| ICMP_UNREACH_PORT3;
4192	returnicmp6default =
4193	(ICMP6_DST_UNREACH1 << 8) \| ICMP6_DST_UNREACH_NOPORT4;
4194	blockpolicy = PFRULE_DROP0x0000;
4195
4196	if ((file = pushfile(filename, 0)) == NULL((void *)0)) {
4197	warn("cannot open the main config file!");
4198	return (-1);
4199	}
4200	topfile = file;
4201
4202	yyparse();
4203	errors = file->errors;
4204	popfile();
4205
4206	/* Free macros and check which have not been used. */
4207	while ((sym = TAILQ_FIRST(&symhead)((&symhead)->tqh_first))) {
4208	if ((pf->opts & PF_OPT_VERBOSE20x00080) && !sym->used)
4209	fprintf(stderr(&__sF[2]), "warning: macro '%s' not "
4210	"used\n", sym->nam);
4211	free(sym->nam);
4212	free(sym->val);
4213	TAILQ_REMOVE(&symhead, sym, entry)do { if (((sym)->entry.tqe_next) != ((void )0)) (sym)-> entry.tqe_next->entry.tqe_prev = (sym)->entry.tqe_prev; else (&symhead)->tqh_last = (sym)->entry.tqe_prev; (sym)->entry.tqe_prev = (sym)->entry.tqe_next; ; ; } while (0);
4214	free(sym);
4215	}
4216
4217	return (errors ? -1 : 0);
4218	}
4219
4220	int
4221	symset(const char nam, const char val, int persist)
4222	{
4223	struct sym *sym;
4224
4225	TAILQ_FOREACH(sym, &symhead, entry)for((sym) = ((&symhead)->tqh_first); (sym) != ((void * )0); (sym) = ((sym)->entry.tqe_next)) {
4226	if (strcmp(nam, sym->nam) == 0)
4227	break;
4228	}
4229
4230	if (sym != NULL((void *)0)) {
4231	if (sym->persist == 1)
4232	return (0);
4233	else {
4234	free(sym->nam);
4235	free(sym->val);
4236	TAILQ_REMOVE(&symhead, sym, entry)do { if (((sym)->entry.tqe_next) != ((void )0)) (sym)-> entry.tqe_next->entry.tqe_prev = (sym)->entry.tqe_prev; else (&symhead)->tqh_last = (sym)->entry.tqe_prev; (sym)->entry.tqe_prev = (sym)->entry.tqe_next; ; ; } while (0);
4237	free(sym);
4238	}
4239	}
4240	if ((sym = calloc(1, sizeof(sym))) == NULL((void )0))
4241	return (-1);
4242
4243	sym->nam = strdup(nam);
4244	if (sym->nam == NULL((void *)0)) {
4245	free(sym);
4246	return (-1);
4247	}
4248	sym->val = strdup(val);
4249	if (sym->val == NULL((void *)0)) {
4250	free(sym->nam);
4251	free(sym);
4252	return (-1);
4253	}
4254	sym->used = 0;
4255	sym->persist = persist;
4256	TAILQ_INSERT_TAIL(&symhead, sym, entry)do { (sym)->entry.tqe_next = ((void )0); (sym)->entry. tqe_prev = (&symhead)->tqh_last; (&symhead)->tqh_last = (sym); (&symhead)->tqh_last = &(sym)->entry. tqe_next; } while (0);
4257	return (0);
4258	}
4259
4260	int
4261	pfctl_cmdline_symset(char *s)
4262	{
4263	char sym, val;
4264	int ret;
4265
4266	if ((val = strrchr(s, '=')) == NULL((void *)0))
4267	return (-1);
4268
4269	sym = strndup(s, val - s);
4270	if (sym == NULL((void *)0))
4271	err(1, "%s", __func__);
4272	ret = symset(sym, val + 1, 1);
4273	free(sym);
4274
4275	return (ret);
4276	}
4277
4278	char *
4279	symget(const char *nam)
4280	{
4281	struct sym *sym;
4282
4283	TAILQ_FOREACH(sym, &symhead, entry)for((sym) = ((&symhead)->tqh_first); (sym) != ((void * )0); (sym) = ((sym)->entry.tqe_next)) {
4284	if (strcmp(nam, sym->nam) == 0) {
4285	sym->used = 1;
4286	return (sym->val);
4287	}
4288	}
4289	return (NULL((void *)0));
4290	}
4291
4292	void
4293	mv_rules(struct pf_ruleset src, struct pf_ruleset dst)
4294	{
4295	struct pf_rule *r;
4296
4297	TAILQ_FOREACH(r, src->rules.active.ptr, entries)for((r) = ((src->rules.active.ptr)->tqh_first); (r) != ( (void *)0); (r) = ((r)->entries.tqe_next))
4298	dst->anchor->match++;
4299	TAILQ_CONCAT(dst->rules.active.ptr, src->rules.active.ptr, entries)do { if (!(((src->rules.active.ptr)->tqh_first) == ((void )0))) { (dst->rules.active.ptr)->tqh_last = (src-> rules.active.ptr)->tqh_first; (src->rules.active.ptr)-> tqh_first->entries.tqe_prev = (dst->rules.active.ptr)-> tqh_last; (dst->rules.active.ptr)->tqh_last = (src-> rules.active.ptr)->tqh_last; do { ((src->rules.active.ptr ))->tqh_first = ((void *)0); ((src->rules.active.ptr))-> tqh_last = &((src->rules.active.ptr))->tqh_first; } while (0); } } while (0);
4300	src->anchor->match = 0;
4301	TAILQ_CONCAT(dst->rules.inactive.ptr, src->rules.inactive.ptr, entries)do { if (!(((src->rules.inactive.ptr)->tqh_first) == (( void )0))) { (dst->rules.inactive.ptr)->tqh_last = (src ->rules.inactive.ptr)->tqh_first; (src->rules.inactive .ptr)->tqh_first->entries.tqe_prev = (dst->rules.inactive .ptr)->tqh_last; (dst->rules.inactive.ptr)->tqh_last = (src->rules.inactive.ptr)->tqh_last; do { ((src-> rules.inactive.ptr))->tqh_first = ((void *)0); ((src->rules .inactive.ptr))->tqh_last = &((src->rules.inactive. ptr))->tqh_first; } while (0); } } while (0);
4302	}
4303
4304	void
4305	decide_address_family(struct node_host n, sa_family_t af)
4306	{
4307	if (af != 0 \|\| n == NULL((void )0))
4308	return;
4309	*af = n->af;
4310	while ((n = n->next) != NULL((void *)0)) {
4311	if (n->af != *af) {
4312	*af = 0;
4313	return;
4314	}
4315	}
4316	}
4317
4318	int
4319	invalid_redirect(struct node_host *nh, sa_family_t af)
4320	{
4321	if (!af) {
4322	struct node_host *n;
4323
4324	/* tables and dyniftl are ok without an address family */
4325	for (n = nh; n != NULL((void *)0); n = n->next) {
4326	if (n->addr.type != PF_ADDR_TABLE &&
4327	n->addr.type != PF_ADDR_DYNIFTL) {
4328	yyerror("address family not given and "
4329	"translation address expands to multiple "
4330	"address families");
4331	return (1);
4332	}
4333	}
4334	}
4335	if (nh == NULL((void *)0)) {
4336	yyerror("no translation address with matching address family "
4337	"found.");
4338	return (1);
4339	}
4340	return (0);
4341	}
4342
4343	int
4344	atoul(char s, u_long ulvalp)
4345	{
4346	u_long ulval;
4347	char *ep;
4348
4349	errno(*__errno()) = 0;
4350	ulval = strtoul(s, &ep, 0);
4351	if (s[0] == '\0' \|\| *ep != '\0')
4352	return (-1);
4353	if (errno(*__errno()) == ERANGE34 && ulval == ULONG_MAX0xffffffffffffffffUL)
4354	return (-1);
4355	*ulvalp = ulval;
4356	return (0);
4357	}
4358
4359	int
4360	getservice(char *n)
4361	{
4362	struct servent *s;
4363	u_long ulval;
4364
4365	if (atoul(n, &ulval) == 0) {
4366	if (ulval > 65535) {
4367	yyerror("illegal port value %lu", ulval);
4368	return (-1);
4369	}
4370	return (htons(ulval)(__uint16_t)(__builtin_constant_p(ulval) ? (__uint16_t)(((__uint16_t )(ulval) & 0xffU) << 8 \| ((__uint16_t)(ulval) & 0xff00U) >> 8) : __swap16md(ulval)));
4371	} else {
4372	s = getservbyname(n, "tcp");
4373	if (s == NULL((void *)0))
4374	s = getservbyname(n, "udp");
4375	if (s == NULL((void *)0)) {
4376	yyerror("unknown port %s", n);
4377	return (-1);
4378	}
4379	return (s->s_port);
4380	}
4381	}
4382
4383	int
4384	rule_label(struct pf_rule r, char s)
4385	{
4386	if (s) {
4387	if (strlcpy(r->label, s, sizeof(r->label)) >=
4388	sizeof(r->label)) {
4389	yyerror("rule label too long (max %zu chars)",
4390	sizeof(r->label)-1);
4391	return (-1);
4392	}
4393	}
4394	return (0);
4395	}
4396
4397	u_int16_t
4398	parseicmpspec(char *w, sa_family_t af)
4399	{
4400	const struct icmpcodeent *p;
4401	u_long ulval;
4402	u_int8_t icmptype;
4403
4404	if (af == AF_INET2)
4405	icmptype = returnicmpdefault >> 8;
4406	else
4407	icmptype = returnicmp6default >> 8;
4408
4409	if (atoul(w, &ulval) == -1) {
4410	if ((p = geticmpcodebyname(icmptype, w, af)) == NULL((void *)0)) {
4411	yyerror("unknown icmp code %s", w);
4412	return (0);
4413	}
4414	ulval = p->code;
4415	}
4416	if (ulval > 255) {
4417	yyerror("invalid icmp code %lu", ulval);
4418	return (0);
4419	}
4420	return (icmptype << 8 \| ulval);
4421	}
4422
4423	int
4424	parseport(char port, struct range r, int extensions)
4425	{
4426	char *p = strchr(port, ':');
4427
4428	if (p == NULL((void *)0)) {
4429	if ((r->a = getservice(port)) == -1)
4430	return (-1);
4431	r->b = 0;
4432	r->t = PF_OP_NONE;
4433	return (0);
4434	}
4435	if ((extensions & PPORT_STAR2) && !strcmp(p+1, "*")) {
4436	*p = 0;
4437	if ((r->a = getservice(port)) == -1)
4438	return (-1);
4439	r->b = 0;
4440	r->t = PF_OP_IRG;
4441	return (0);
4442	}
4443	if ((extensions & PPORT_RANGE1)) {
4444	*p++ = 0;
4445	if ((r->a = getservice(port)) == -1 \|\|
4446	(r->b = getservice(p)) == -1)
4447	return (-1);
4448	if (r->a == r->b) {
4449	r->b = 0;
4450	r->t = PF_OP_NONE;
4451	} else
4452	r->t = PF_OP_RRG;
4453	return (0);
4454	}
4455	yyerror("port is invalid: %s", port);
4456	return (-1);
4457	}
4458
4459	int
4460	pfctl_load_anchors(int dev, struct pfctl pf, struct pfr_buffer trans)
4461	{
4462	struct loadanchors *la;
4463
4464	TAILQ_FOREACH(la, &loadanchorshead, entries)for((la) = ((&loadanchorshead)->tqh_first); (la) != (( void *)0); (la) = ((la)->entries.tqe_next)) {
4465	if (pf->opts & PF_OPT_VERBOSE0x00004)
4466	fprintf(stderr(&__sF[2]), "\nLoading anchor %s from %s\n",
4467	la->anchorname, la->filename);
4468	if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize,
4469	la->anchorname, trans) == -1)
4470	return (-1);
4471	}
4472
4473	return (0);
4474	}
4475
4476	int
4477	kw_casecmp(const void k, const void e)
4478	{
4479	return (strcasecmp(k, ((const struct keywords *)e)->k_name));
4480	}
4481
4482	int
4483	map_tos(char s, int val)
4484	{
4485	/* DiffServ Codepoints and other TOS mappings */
4486	const struct keywords toswords[] = {
4487	{ "af11", IPTOS_DSCP_AF110x28 },
4488	{ "af12", IPTOS_DSCP_AF120x30 },
4489	{ "af13", IPTOS_DSCP_AF130x38 },
4490	{ "af21", IPTOS_DSCP_AF210x48 },
4491	{ "af22", IPTOS_DSCP_AF220x50 },
4492	{ "af23", IPTOS_DSCP_AF230x58 },
4493	{ "af31", IPTOS_DSCP_AF310x68 },
4494	{ "af32", IPTOS_DSCP_AF320x70 },
4495	{ "af33", IPTOS_DSCP_AF330x78 },
4496	{ "af41", IPTOS_DSCP_AF410x88 },
4497	{ "af42", IPTOS_DSCP_AF420x90 },
4498	{ "af43", IPTOS_DSCP_AF430x98 },
4499	{ "critical", IPTOS_PREC_CRITIC_ECP0xa0 },
4500	{ "cs0", IPTOS_DSCP_CS00x00 },
4501	{ "cs1", IPTOS_DSCP_CS10x20 },
4502	{ "cs2", IPTOS_DSCP_CS20x40 },
4503	{ "cs3", IPTOS_DSCP_CS30x60 },
4504	{ "cs4", IPTOS_DSCP_CS40x80 },
4505	{ "cs5", IPTOS_DSCP_CS50xa0 },
4506	{ "cs6", IPTOS_DSCP_CS60xc0 },
4507	{ "cs7", IPTOS_DSCP_CS70xe0 },
4508	{ "ef", IPTOS_DSCP_EF0xb8 },
4509	{ "inetcontrol", IPTOS_PREC_INTERNETCONTROL0xc0 },
4510	{ "lowdelay", IPTOS_LOWDELAY0x10 },
4511	{ "netcontrol", IPTOS_PREC_NETCONTROL0xe0 },
4512	{ "reliability", IPTOS_RELIABILITY0x04 },
4513	{ "throughput", IPTOS_THROUGHPUT0x08 }
4514	};
4515	const struct keywords *p;
4516
4517	p = bsearch(s, toswords, sizeof(toswords)/sizeof(toswords[0]),
4518	sizeof(toswords[0]), kw_casecmp);
4519
4520	if (p) {
4521	*val = p->k_val;
4522	return (1);
4523	}
4524	return (0);
4525	}
4526
4527	int
4528	lookup_rtable(u_int rtableid)
4529	{
4530	size_t len;
4531	struct rt_tableinfo info;
4532	int mib[6];
4533	static u_int found[RT_TABLEID_MAX255+1];
4534
4535	if (found[rtableid])
4536	return found[rtableid];
4537
4538	mib[0] = CTL_NET4;
4539	mib[1] = PF_ROUTE17;
4540	mib[2] = 0;
4541	mib[3] = 0;
4542	mib[4] = NET_RT_TABLE5;
4543	mib[5] = rtableid;
4544
4545	len = sizeof(info);
4546	if (sysctl(mib, 6, &info, &len, NULL((void *)0), 0) == -1) {
4547	if (errno(*__errno()) == ENOENT2) {
4548	/* table nonexistent */
4549	found[rtableid] = 0;
4550	return 0;
4551	}
4552	err(1, "%s", __func__);
4553	}
4554	found[rtableid] = 1;
4555	return 1;
4556	}
4557
4558	int
4559	filteropts_to_rule(struct pf_rule r, struct filter_opts opts)
4560	{
4561	if (opts->marker & FOM_ONCE0x1000) {
4562	if ((r->action != PF_PASS && r->action != PF_DROP) \|\| r->anchor) {
4563	yyerror("'once' only applies to pass/block rules");
4564	return (1);
4565	}
4566	r->rule_flag \|= PFRULE_ONCE0x00100000;
4567	}
4568
4569	r->keep_state = opts->keep.action;
4570	r->pktrate.limit = opts->pktrate.limit;
4571	r->pktrate.seconds = opts->pktrate.seconds;
4572	r->prob = opts->prob;
4573	r->rtableid = opts->rtableid;
4574	r->tos = opts->tos;
4575
4576	if (opts->nodf)
4577	r->scrub_flags \|= PFSTATE_NODF0x0020;
4578	if (opts->randomid)
4579	r->scrub_flags \|= PFSTATE_RANDOMID0x0080;
4580	if (opts->minttl)
4581	r->min_ttl = opts->minttl;
4582	if (opts->max_mss)
4583	r->max_mss = opts->max_mss;
4584
4585	if (opts->tag)
4586	if (strlcpy(r->tagname, opts->tag,
4587	PF_TAG_NAME_SIZE64) >= PF_TAG_NAME_SIZE64) {
4588	yyerror("tag too long, max %u chars",
4589	PF_TAG_NAME_SIZE64 - 1);
4590	return (1);
4591	}
4592	if (opts->match_tag)
4593	if (strlcpy(r->match_tagname, opts->match_tag,
4594	PF_TAG_NAME_SIZE64) >= PF_TAG_NAME_SIZE64) {
4595	yyerror("tag too long, max %u chars",
4596	PF_TAG_NAME_SIZE64 - 1);
4597	return (1);
4598	}
4599	r->match_tag_not = opts->match_tag_not;
4600
4601	if (rule_label(r, opts->label))
4602	return (1);
4603	free(opts->label);
4604
4605	if (opts->marker & FOM_AFTO0x0080)
4606	r->rule_flag \|= PFRULE_AFTO0x00200000;
4607	if ((opts->marker & FOM_AFTO0x0080) && r->direction != PF_IN) {
4608	yyerror("af-to can only be used with direction in");
4609	return (1);
4610	}
4611	if ((opts->marker & FOM_AFTO0x0080) && opts->rt) {
4612	yyerror("af-to cannot be used together with "
4613	"route-to, reply-to, dup-to");
4614	return (1);
4615	}
4616	if (opts->marker & FOM_SCRUB_TCP0x0200)
4617	r->scrub_flags \|= PFSTATE_SCRUB_TCP0x0100;
4618	if (opts->marker & FOM_SETDELAY0x4000) {
4619	r->delay = opts->delay;
4620	r->rule_flag \|= PFRULE_SETDELAY0x0080;
4621	}
4622	if (opts->marker & FOM_SETPRIO0x0400) {
4623	r->set_prio[0] = opts->set_prio[0];
4624	r->set_prio[1] = opts->set_prio[1];
4625	r->scrub_flags \|= PFSTATE_SETPRIO0x0200;
4626	}
4627	if (opts->marker & FOM_SETTOS0x0100) {
4628	r->scrub_flags \|= PFSTATE_SETTOS0x0040;
4629	r->set_tos = opts->settos;
4630	}
4631	if (opts->marker & FOM_PRIO0x2000)
4632	r->prio = opts->prio ? opts->prio : PF_PRIO_ZERO0xff;
4633	if (opts->marker & FOM_SETPRIO0x0400) {
4634	r->set_prio[0] = opts->set_prio[0];
4635	r->set_prio[1] = opts->set_prio[1];
4636	r->scrub_flags \|= PFSTATE_SETPRIO0x0200;
4637	}
4638
4639	r->flags = opts->flags.b1;
4640	r->flagset = opts->flags.b2;
4641	if ((opts->flags.b1 & opts->flags.b2) != opts->flags.b1) {
4642	yyerror("flags always false");
4643	return (1);
4644	}
4645
4646	if (opts->queues.qname != NULL((void *)0)) {
4647	if (strlcpy(r->qname, opts->queues.qname,
4648	sizeof(r->qname)) >= sizeof(r->qname)) {
4649	yyerror("rule qname too long (max "
4650	"%zu chars)", sizeof(r->qname)-1);
4651	return (1);
4652	}
4653	free(opts->queues.qname);
4654	}
4655	if (opts->queues.pqname != NULL((void *)0)) {
4656	if (strlcpy(r->pqname, opts->queues.pqname,
4657	sizeof(r->pqname)) >= sizeof(r->pqname)) {
4658	yyerror("rule pqname too long (max "
4659	"%zu chars)", sizeof(r->pqname)-1);
4660	return (1);
4661	}
4662	free(opts->queues.pqname);
4663	}
4664
4665	if (opts->fragment)
4666	r->rule_flag \|= PFRULE_FRAGMENT0x0002;
4667	r->allow_opts = opts->allowopts;
4668
4669	return (0);
4670	}
4671	#line 4664 "parse.c"
4672	/* allocate initial stack or double stack size, up to YYMAXDEPTH */
4673	static int yygrowstack(void)
4674	{
4675	unsigned int newsize;
4676	long sslen;
4677	short *newss;
4678	YYSTYPE *newvs;
4679
4680	if ((newsize = yystacksize) == 0)
4681	newsize = YYINITSTACKSIZE200;
4682	else if (newsize >= YYMAXDEPTH10000)
4683	return -1;
4684	else if ((newsize *= 2) > YYMAXDEPTH10000)
4685	newsize = YYMAXDEPTH10000;
4686	sslen = yyssp - yyss;
4687	#ifdef SIZE_MAX
4688	#define YY_SIZE_MAX0xffffffffU SIZE_MAX
4689	#else
4690	#define YY_SIZE_MAX0xffffffffU 0xffffffffU
4691	#endif
4692	if (newsize && YY_SIZE_MAX0xffffffffU / newsize < sizeof *newss)
4693	goto bail;
4694	newss = (short )realloc(yyss, newsize sizeof *newss);
4695	if (newss == NULL((void *)0))
4696	goto bail;
4697	yyss = newss;
4698	yyssp = newss + sslen;
4699	if (newsize && YY_SIZE_MAX0xffffffffU / newsize < sizeof *newvs)
4700	goto bail;
4701	newvs = (YYSTYPE )realloc(yyvs, newsize sizeof *newvs);
4702	if (newvs == NULL((void *)0))
4703	goto bail;
4704	yyvs = newvs;
4705	yyvsp = newvs + sslen;
4706	yystacksize = newsize;
4707	yysslim = yyss + newsize - 1;
4708	return 0;
4709	bail:
4710	if (yyss)
4711	free(yyss);
4712	if (yyvs)
4713	free(yyvs);
4714	yyss = yyssp = NULL((void *)0);
4715	yyvs = yyvsp = NULL((void *)0);
4716	yystacksize = 0;
4717	return -1;
4718	}
4719
4720	#define YYABORTgoto yyabort goto yyabort
4721	#define YYREJECTgoto yyabort goto yyabort
4722	#define YYACCEPTgoto yyaccept goto yyaccept
4723	#define YYERRORgoto yyerrlab goto yyerrlab
4724	int
4725	yyparse(void)
4726	{
4727	int yym, yyn, yystate;
4728	#if YYDEBUG0
4729	const char *yys;
4730
4731	if ((yys = getenv("YYDEBUG")))
4732	{
4733	yyn = *yys;
4734	if (yyn >= '0' && yyn <= '9')
4735	yydebug = yyn - '0';
4736	}
4737	#endif /* YYDEBUG */
4738
4739	yynerrs = 0;
4740	yyerrflag = 0;
4741	yychar = (-1);
4742
4743	if (yyss == NULL((void *)0) && yygrowstack()) goto yyoverflow;
4744	yyssp = yyss;
4745	yyvsp = yyvs;
4746	*yyssp = yystate = 0;
4747
4748	yyloop:
4749	if ((yyn = yydefred[yystate]) != 0) goto yyreduce;
4750	if (yychar < 0)
4751	{
4752	if ((yychar = yylex()) < 0) yychar = 0;
4753	#if YYDEBUG0
4754	if (yydebug)
4755	{
4756	yys = 0;
4757	if (yychar <= YYMAXTOKEN385) yys = yyname[yychar];
4758	if (!yys) yys = "illegal-symbol";
4759	printf("%sdebug: state %d, reading %d (%s)\n",
4760	YYPREFIX"yy", yystate, yychar, yys);
4761	}
4762	#endif
4763	}
4764	if ((yyn = yysindex[yystate]) && (yyn += yychar) >= 0 &&
4765	yyn <= YYTABLESIZE5732 && yycheck[yyn] == yychar)
4766	{
4767	#if YYDEBUG0
4768	if (yydebug)
4769	printf("%sdebug: state %d, shifting to state %d\n",
4770	YYPREFIX"yy", yystate, yytable[yyn]);
4771	#endif
4772	if (yyssp >= yysslim && yygrowstack())
4773	{
4774	goto yyoverflow;
4775	}
4776	*++yyssp = yystate = yytable[yyn];
4777	*++yyvsp = yylval;
4778	yychar = (-1);
4779	if (yyerrflag > 0) --yyerrflag;
4780	goto yyloop;
4781	}
4782	if ((yyn = yyrindex[yystate]) && (yyn += yychar) >= 0 &&
4783	yyn <= YYTABLESIZE5732 && yycheck[yyn] == yychar)
4784	{
4785	yyn = yytable[yyn];
4786	goto yyreduce;
4787	}
4788	if (yyerrflag) goto yyinrecovery;
4789	#if defined(__GNUC__4)
4790	goto yynewerror;
4791	#endif
4792	yynewerror:
4793	yyerror("syntax error");
4794	#if defined(__GNUC__4)
4795	goto yyerrlab;
4796	#endif
4797	yyerrlab:
4798	++yynerrs;
4799	yyinrecovery:
4800	if (yyerrflag < 3)
4801	{
4802	yyerrflag = 3;
4803	for (;;)
4804	{
4805	if ((yyn = yysindex[*yyssp]) && (yyn += YYERRCODE256) >= 0 &&
4806	yyn <= YYTABLESIZE5732 && yycheck[yyn] == YYERRCODE256)
4807	{
4808	#if YYDEBUG0
4809	if (yydebug)
4810	printf("%sdebug: state %d, error recovery shifting\
4811	to state %d\n", YYPREFIX"yy", *yyssp, yytable[yyn]);
4812	#endif
4813	if (yyssp >= yysslim && yygrowstack())
4814	{
4815	goto yyoverflow;
4816	}
4817	*++yyssp = yystate = yytable[yyn];
4818	*++yyvsp = yylval;
4819	goto yyloop;
4820	}
4821	else
4822	{
4823	#if YYDEBUG0
4824	if (yydebug)
4825	printf("%sdebug: error recovery discarding state %d\n",
4826	YYPREFIX"yy", *yyssp);
4827	#endif
4828	if (yyssp <= yyss) goto yyabort;
4829	--yyssp;
4830	--yyvsp;
4831	}
4832	}
4833	}
4834	else
4835	{
4836	if (yychar == 0) goto yyabort;
4837	#if YYDEBUG0
4838	if (yydebug)
4839	{
4840	yys = 0;
4841	if (yychar <= YYMAXTOKEN385) yys = yyname[yychar];
4842	if (!yys) yys = "illegal-symbol";
4843	printf("%sdebug: state %d, error recovery discards token %d (%s)\n",
4844	YYPREFIX"yy", yystate, yychar, yys);
4845	}
4846	#endif
4847	yychar = (-1);
4848	goto yyloop;
4849	}
4850	yyreduce:
4851	#if YYDEBUG0
4852	if (yydebug)
4853	printf("%sdebug: state %d, reducing by rule %d (%s)\n",
4854	YYPREFIX"yy", yystate, yyn, yyrule[yyn]);
4855	#endif
4856	yym = yylen[yyn];
4857	if (yym)
4858	yyval = yyvsp[1-yym];
4859	else
4860	memset(&yyval, 0, sizeof yyval);
4861	switch (yyn)
4862	{
4863	case 13:
4864	#line 548 "/usr/src/sbin/pfctl/parse.y"
4865	{ file->errors++; }
4866	break;
4867	case 14:
4868	#line 551 "/usr/src/sbin/pfctl/parse.y"
4869	{
4870	struct file *nfile;
4871
4872	if ((nfile = pushfile(yyvsp[0].v.string, 0)) == NULL((void *)0)) {
4873	yyerror("failed to include file %s", yyvsp[0].v.string);
4874	free(yyvsp[0].v.string);
4875	YYERRORgoto yyerrlab;
4876	}
4877	free(yyvsp[0].v.string);
4878
4879	file = nfile;
4880	lungetc('\n');
4881	}
4882	break;
4883	case 19:
4884	#line 576 "/usr/src/sbin/pfctl/parse.y"
4885	{
4886	if (!strcmp(yyvsp[0].v.string, "none"))
4887	yyval.v.i = 0;
4888	else if (!strcmp(yyvsp[0].v.string, "basic"))
4889	yyval.v.i = PF_OPTIMIZE_BASIC0x0001;
4890	else if (!strcmp(yyvsp[0].v.string, "profile"))
4891	yyval.v.i = PF_OPTIMIZE_BASIC0x0001 \| PF_OPTIMIZE_PROFILE0x0002;
4892	else {
4893	yyerror("unknown ruleset-optimization %s", yyvsp[0].v.string);
4894	YYERRORgoto yyerrlab;
4895	}
4896	}
4897	break;
4898	case 20:
4899	#line 590 "/usr/src/sbin/pfctl/parse.y"
4900	{ yyval.v.number = 0; }
4901	break;
4902	case 21:
4903	#line 591 "/usr/src/sbin/pfctl/parse.y"
4904	{ yyval.v.number = 1; }
4905	break;
4906	case 22:
4907	#line 594 "/usr/src/sbin/pfctl/parse.y"
4908	{
4909	pfctl_set_reassembly(pf, yyvsp[-1].v.number, yyvsp[0].v.number);
4910	}
4911	break;
4912	case 23:
4913	#line 597 "/usr/src/sbin/pfctl/parse.y"
4914	{
4915	if (pfctl_set_optimization(pf, yyvsp[0].v.string) != 0) {
4916	yyerror("unknown optimization %s", yyvsp[0].v.string);
4917	free(yyvsp[0].v.string);
4918	YYERRORgoto yyerrlab;
4919	}
4920	free(yyvsp[0].v.string);
4921	}
4922	break;
4923	case 24:
4924	#line 605 "/usr/src/sbin/pfctl/parse.y"
4925	{
4926	if (!(pf->opts & PF_OPT_OPTIMIZE0x00800)) {
4927	pf->opts \|= PF_OPT_OPTIMIZE0x00800;
4928	pf->optimize = yyvsp[0].v.i;
4929	}
4930	}
4931	break;
4932	case 29:
4933	#line 615 "/usr/src/sbin/pfctl/parse.y"
4934	{
4935	if (pfctl_set_logif(pf, yyvsp[0].v.string) != 0) {
4936	yyerror("error setting loginterface %s", yyvsp[0].v.string);
4937	free(yyvsp[0].v.string);
4938	YYERRORgoto yyerrlab;
4939	}
4940	free(yyvsp[0].v.string);
4941	}
4942	break;
4943	case 30:
4944	#line 623 "/usr/src/sbin/pfctl/parse.y"
4945	{
4946	if (yyvsp[0].v.number == 0 \|\| yyvsp[0].v.number > UINT_MAX0xffffffffU) {
4947	yyerror("hostid must be non-zero");
4948	YYERRORgoto yyerrlab;
4949	}
4950	pfctl_set_hostid(pf, yyvsp[0].v.number);
4951	}
4952	break;
4953	case 31:
4954	#line 630 "/usr/src/sbin/pfctl/parse.y"
4955	{
4956	if (pf->opts & PF_OPT_VERBOSE0x00004)
4957	printf("set block-policy drop\n");
4958	blockpolicy = PFRULE_DROP0x0000;
4959	}
4960	break;
4961	case 32:
4962	#line 635 "/usr/src/sbin/pfctl/parse.y"
4963	{
4964	if (pf->opts & PF_OPT_VERBOSE0x00004)
4965	printf("set block-policy return\n");
4966	blockpolicy = PFRULE_RETURN0x0008;
4967	}
4968	break;
4969	case 33:
4970	#line 640 "/usr/src/sbin/pfctl/parse.y"
4971	{
4972	if (pf->opts & PF_OPT_VERBOSE0x00004)
4973	printf("set fingerprints \"%s\"\n", yyvsp[0].v.string);
4974	if (!pf->anchor->name[0]) {
4975	if (pfctl_file_fingerprints(pf->dev,
4976	pf->opts, yyvsp[0].v.string)) {
4977	yyerror("error loading "
4978	"fingerprints %s", yyvsp[0].v.string);
4979	free(yyvsp[0].v.string);
4980	YYERRORgoto yyerrlab;
4981	}
4982	}
4983	free(yyvsp[0].v.string);
4984	}
4985	break;
4986	case 34:
4987	#line 654 "/usr/src/sbin/pfctl/parse.y"
4988	{
4989	if (pf->opts & PF_OPT_VERBOSE0x00004)
4990	switch (yyvsp[0].v.i) {
4991	case 0:
4992	printf("set state-policy floating\n");
4993	break;
4994	case PFRULE_IFBOUND0x00010000:
4995	printf("set state-policy if-bound\n");
4996	break;
4997	}
4998	default_statelock = yyvsp[0].v.i;
4999	}
5000	break;
5001	case 35:
5002	#line 666 "/usr/src/sbin/pfctl/parse.y"
5003	{
5004	if (pfctl_set_debug(pf, yyvsp[0].v.string) != 0) {
5005	yyerror("error setting debuglevel %s", yyvsp[0].v.string);
5006	free(yyvsp[0].v.string);
5007	YYERRORgoto yyerrlab;
5008	}
5009	free(yyvsp[0].v.string);
5010	}
5011	break;
5012	case 36:
5013	#line 674 "/usr/src/sbin/pfctl/parse.y"
5014	{
5015	if (pfctl_set_debug(pf, "debug") != 0) {
5016	yyerror("error setting debuglevel %s", "debug");
5017	YYERRORgoto yyerrlab;
5018	}
5019	}
5020	break;
5021	case 37:
5022	#line 680 "/usr/src/sbin/pfctl/parse.y"
5023	{
5024	if (expand_skip_interface(yyvsp[0].v.interface) != 0) {
5025	yyerror("error setting skip interface(s)");
5026	YYERRORgoto yyerrlab;
5027	}
5028	}
5029	break;
5030	case 38:
5031	#line 686 "/usr/src/sbin/pfctl/parse.y"
5032	{
5033	if (keep_state_defaults != NULL((void *)0)) {
5034	yyerror("cannot redefine state-defaults");
5035	YYERRORgoto yyerrlab;
5036	}
5037	keep_state_defaults = yyvsp[0].v.state_opt;
5038	}
5039	break;
5040	case 39:
5041	#line 693 "/usr/src/sbin/pfctl/parse.y"
5042	{
5043	if (pfctl_set_syncookies(pf, yyvsp[-1].v.i, yyvsp[0].v.watermarks)) {
5044	yyerror("error setting syncookies");
5045	YYERRORgoto yyerrlab;
5046	}
5047	}
5048	break;
5049	case 40:
5050	#line 701 "/usr/src/sbin/pfctl/parse.y"
5051	{
5052	if (!strcmp(yyvsp[0].v.string, "never"))
5053	yyval.v.i = PF_SYNCOOKIES_NEVER0;
5054	else if (!strcmp(yyvsp[0].v.string, "adaptive"))
5055	yyval.v.i = PF_SYNCOOKIES_ADAPTIVE2;
5056	else if (!strcmp(yyvsp[0].v.string, "always"))
5057	yyval.v.i = PF_SYNCOOKIES_ALWAYS1;
5058	else {
5059	yyerror("illegal value for syncookies");
5060	YYERRORgoto yyerrlab;
5061	}
5062	}
5063	break;
5064	case 41:
5065	#line 715 "/usr/src/sbin/pfctl/parse.y"
5066	{ yyval.v.watermarks = NULL((void *)0); }
5067	break;
5068	case 42:
5069	#line 716 "/usr/src/sbin/pfctl/parse.y"
5070	{
5071	memset(&syncookie_opts, 0, sizeof(syncookie_opts));
5072	}
5073	break;
5074	case 43:
5075	#line 718 "/usr/src/sbin/pfctl/parse.y"
5076	{ yyval.v.watermarks = &syncookie_opts; }
5077	break;
5078	case 46:
5079	#line 725 "/usr/src/sbin/pfctl/parse.y"
5080	{
5081	double val;
5082	char *cp;
5083
5084	val = strtod(yyvsp[0].v.string, &cp);
5085	if (cp == NULL((void *)0) \|\| strcmp(cp, "%"))
5086	YYERRORgoto yyerrlab;
5087	if (val <= 0 \|\| val > 100) {
5088	yyerror("illegal percentage value");
5089	YYERRORgoto yyerrlab;
5090	}
5091	if (!strcmp(yyvsp[-1].v.string, "start")) {
5092	syncookie_opts.hi = val;
5093	} else if (!strcmp(yyvsp[-1].v.string, "end")) {
5094	syncookie_opts.lo = val;
5095	} else {
5096	yyerror("illegal syncookie option");
5097	YYERRORgoto yyerrlab;
5098	}
5099	}
5100	break;
5101	case 47:
5102	#line 747 "/usr/src/sbin/pfctl/parse.y"
5103	{ yyval.v.string = yyvsp[0].v.string; }
5104	break;
5105	case 48:
5106	#line 748 "/usr/src/sbin/pfctl/parse.y"
5107	{
5108	if ((yyval.v.string = strdup("all")) == NULL((void *)0)) {
5109	err(1, "stringall: strdup");
5110	}
5111	}
5112	break;
5113	case 49:
5114	#line 755 "/usr/src/sbin/pfctl/parse.y"
5115	{
5116	if (asprintf(&yyval.v.string, "%s %s", yyvsp[-1].v.string, yyvsp[0].v.string) == -1)
5117	err(1, "string: asprintf");
5118	free(yyvsp[-1].v.string);
5119	free(yyvsp[0].v.string);
5120	}
5121	break;
5122	case 51:
5123	#line 764 "/usr/src/sbin/pfctl/parse.y"
5124	{
5125	if (asprintf(&yyval.v.string, "%s %s", yyvsp[-1].v.string, yyvsp[0].v.string) == -1)
5126	err(1, "string: asprintf");
5127	free(yyvsp[-1].v.string);
5128	free(yyvsp[0].v.string);
5129	}
5130	break;
5131	case 53:
5132	#line 773 "/usr/src/sbin/pfctl/parse.y"
5133	{
5134	char *s;
5135	if (asprintf(&s, "%lld", yyvsp[0].v.number) == -1) {
5136	yyerror("string: asprintf");
5137	YYERRORgoto yyerrlab;
5138	}
5139	yyval.v.string = s;
5140	}
5141	break;
5142	case 55:
5143	#line 784 "/usr/src/sbin/pfctl/parse.y"
5144	{
5145	char *s = yyvsp[-2].v.string;
5146	if (pf->opts & PF_OPT_VERBOSE0x00004)
5147	printf("%s = \"%s\"\n", yyvsp[-2].v.string, yyvsp[0].v.string);
5148	while (*s++) {
5149	if (isspace((unsigned char)*s)) {
5150	yyerror("macro name cannot contain "
5151	"whitespace");
5152	free(yyvsp[-2].v.string);
5153	free(yyvsp[0].v.string);
5154	YYERRORgoto yyerrlab;
5155	}
5156	}
5157	if (symset(yyvsp[-2].v.string, yyvsp[0].v.string, 0) == -1)
5158	err(1, "cannot store variable %s", yyvsp[-2].v.string);
5159	free(yyvsp[-2].v.string);
5160	free(yyvsp[0].v.string);
5161	}
5162	break;
5163	case 56:
5164	#line 804 "/usr/src/sbin/pfctl/parse.y"
5165	{
5166	if (yyvsp[0].v.string[0] == '\0') {
5167	free(yyvsp[0].v.string);
5168	yyerror("anchor name must not be empty");
5169	YYERRORgoto yyerrlab;
5170	}
5171	if (strlen(pf->anchor->path) + 1 +
5172	strlen(yyvsp[0].v.string) >= PATH_MAX1024) {
5173	free(yyvsp[0].v.string);
5174	yyerror("anchor name is longer than %u",
5175	PATH_MAX1024 - 1);
5176	YYERRORgoto yyerrlab;
5177	}
5178	if (yyvsp[0].v.string[0] == '_' \|\| strstr(yyvsp[0].v.string, "/_") != NULL((void *)0)) {
5179	free(yyvsp[0].v.string);
5180	yyerror("anchor names beginning with '_' "
5181	"are reserved for internal use");
5182	YYERRORgoto yyerrlab;
5183	}
5184	yyval.v.string = yyvsp[0].v.string;
5185	}
5186	break;
5187	case 57:
5188	#line 825 "/usr/src/sbin/pfctl/parse.y"
5189	{ yyval.v.string = NULL((void *)0); }
5190	break;
5191	case 63:
5192	#line 836 "/usr/src/sbin/pfctl/parse.y"
5193	{
5194	char ta[PF_ANCHOR_NAME_SIZE64];
5195	struct pf_ruleset *rs;
5196
5197	/* steping into a brace anchor */
5198	pf->asd++;
5199	if (pf->asd >= PFCTL_ANCHOR_STACK_DEPTH64)
5200	errx(1, "pfa_anchor: anchors too deep");
5201	pf->bn++;
5202	pf->brace = 1;
5203
5204	/*
5205	* Anchor contents are parsed before the anchor rule
5206	* production completes, so we don't know the real
5207	* location yet. Create a holding ruleset in the root;
5208	* contents will be moved afterwards.
5209	*/
5210	snprintf(ta, PF_ANCHOR_NAME_SIZE64, "_%d", pf->bn);
5211	rs = pf_find_or_create_ruleset(ta);
5212	if (rs == NULL((void *)0))
5213	err(1, "pfa_anchor: pf_find_or_create_ruleset");
5214	pf->astack[pf->asd] = rs->anchor;
5215	pf->anchor = rs->anchor;
5216	}
5217	break;
5218	case 64:
5219	#line 860 "/usr/src/sbin/pfctl/parse.y"
5220	{
5221	pf->alast = pf->anchor;
5222	pf->asd--;
5223	pf->anchor = pf->astack[pf->asd];
5224	}
5225	break;
5226	case 66:
5227	#line 870 "/usr/src/sbin/pfctl/parse.y"
5228	{
5229	struct pf_rule r;
5230	struct node_proto *proto;
5231	char *p;
5232
5233	memset(&r, 0, sizeof(r));
5234	if (pf->astack[pf->asd + 1]) {
5235	if (yyvsp[-8].v.string && strchr(yyvsp[-8].v.string, '/') != NULL((void *)0)) {
5236	free(yyvsp[-8].v.string);
5237	yyerror("anchor paths containing '/' "
5238	"cannot be used for inline anchors.");
5239	YYERRORgoto yyerrlab;
5240	}
5241
5242	/* Move inline rules into relative location. */
5243	pf_anchor_setup(&r,
5244	&pf->astack[pf->asd]->ruleset,
5245	yyvsp[-8].v.string ? yyvsp[-8].v.string : pf->alast->name);
5246
5247	if (r.anchor == NULL((void *)0))
5248	err(1, "anchorrule: unable to "
5249	"create ruleset");
5250
5251	if (pf->alast != r.anchor) {
5252	if (r.anchor->match) {
5253	yyerror("inline anchor '%s' "
5254	"already exists",
5255	r.anchor->name);
5256	YYERRORgoto yyerrlab;
5257	}
5258	mv_rules(&pf->alast->ruleset,
5259	&r.anchor->ruleset);
5260	}
5261	pf_remove_if_empty_ruleset(&pf->alast->ruleset);
5262	pf->alast = r.anchor;
5263	} else {
5264	if (!yyvsp[-8].v.string) {
5265	yyerror("anchors without explicit "
5266	"rules must specify a name");
5267	YYERRORgoto yyerrlab;
5268	}
5269
5270	/*
5271	* Don't make non-brace anchors part of the main anchor pool.
5272	*/
5273	if ((r.anchor = calloc(1, sizeof(r.anchor))) == NULL((void )0)) {
5274	err(1, "anchorrule: calloc");
5275	}
5276	pf_init_ruleset(&r.anchor->ruleset);
5277	r.anchor->ruleset.anchor = r.anchor;
5278	if (strlcpy(r.anchor->path, yyvsp[-8].v.string,
5279	sizeof(r.anchor->path)) >= sizeof(r.anchor->path)) {
5280	errx(1, "anchorrule: strlcpy");
5281	}
5282	if ((p = strrchr(yyvsp[-8].v.string, '/')) != NULL((void *)0)) {
5283	if (strlen(p) == 1) {
5284	yyerror("anchorrule: bad anchor name %s",
5285	yyvsp[-8].v.string);
5286	YYERRORgoto yyerrlab;
5287	}
5288	} else
5289	p = yyvsp[-8].v.string;
5290	if (strlcpy(r.anchor->name, p,
5291	sizeof(r.anchor->name)) >= sizeof(r.anchor->name)) {
5292	errx(1, "anchorrule: strlcpy");
5293	}
5294	}
5295
5296	r.direction = yyvsp[-7].v.i;
5297	r.quick = yyvsp[-6].v.logquick.quick;
5298	r.af = yyvsp[-4].v.i;
5299
5300	if (yyvsp[-1].v.filter_opts.flags.b1 \|\| yyvsp[-1].v.filter_opts.flags.b2 \|\| yyvsp[-2].v.fromto.src_os) {
5301	for (proto = yyvsp[-3].v.proto; proto != NULL((void *)0) &&
5302	proto->proto != IPPROTO_TCP6;
5303	proto = proto->next)
5304	; /* nothing */
5305	if (proto == NULL((void )0) && yyvsp[-3].v.proto != NULL((void )0)) {
5306	if (yyvsp[-1].v.filter_opts.flags.b1 \|\| yyvsp[-1].v.filter_opts.flags.b2)
5307	yyerror(
5308	"flags only apply to tcp");
5309	if (yyvsp[-2].v.fromto.src_os)
5310	yyerror(
5311	"OS fingerprinting only "
5312	"applies to tcp");
5313	YYERRORgoto yyerrlab;
5314	}
5315	}
5316
5317	if (filteropts_to_rule(&r, &yyvsp[-1].v.filter_opts))
5318	YYERRORgoto yyerrlab;
5319
5320	if (yyvsp[-1].v.filter_opts.keep.action) {
5321	yyerror("cannot specify state handling "
5322	"on anchors");
5323	YYERRORgoto yyerrlab;
5324	}
5325
5326	if (yyvsp[-1].v.filter_opts.rt) {
5327	yyerror("cannot specify route handling "
5328	"on anchors");
5329	YYERRORgoto yyerrlab;
5330	}
5331
5332	decide_address_family(yyvsp[-2].v.fromto.src.host, &r.af);
5333	decide_address_family(yyvsp[-2].v.fromto.dst.host, &r.af);
5334
5335	expand_rule(&r, 0, yyvsp[-5].v.interface, NULL((void )0), NULL((void )0), NULL((void *)0), yyvsp[-3].v.proto, yyvsp[-2].v.fromto.src_os,
5336	yyvsp[-2].v.fromto.src.host, yyvsp[-2].v.fromto.src.port, yyvsp[-2].v.fromto.dst.host, yyvsp[-2].v.fromto.dst.port,
5337	yyvsp[-1].v.filter_opts.uid, yyvsp[-1].v.filter_opts.gid, yyvsp[-1].v.filter_opts.rcv, yyvsp[-1].v.filter_opts.icmpspec);
5338	free(yyvsp[-8].v.string);
5339	pf->astack[pf->asd + 1] = NULL((void *)0);
5340	}
5341	break;
5342	case 67:
5343	#line 985 "/usr/src/sbin/pfctl/parse.y"
5344	{
5345	struct loadanchors *loadanchor;
5346
5347	if (yyvsp[-2].v.string == NULL((void *)0)) {
5348	yyerror("anchor name is missing");
5349	YYERRORgoto yyerrlab;
5350	}
5351	loadanchor = calloc(1, sizeof(struct loadanchors));
5352	if (loadanchor == NULL((void *)0))
5353	err(1, "loadrule: calloc");
5354	if ((loadanchor->anchorname = malloc(PATH_MAX1024)) ==
5355	NULL((void *)0))
5356	err(1, "loadrule: malloc");
5357	if (pf->anchor->name[0])
5358	snprintf(loadanchor->anchorname, PATH_MAX1024,
5359	"%s/%s", pf->anchor->path, yyvsp[-2].v.string);
5360	else
5361	strlcpy(loadanchor->anchorname, yyvsp[-2].v.string, PATH_MAX1024);
5362	if ((loadanchor->filename = strdup(yyvsp[0].v.string)) == NULL((void *)0))
5363	err(1, "loadrule: strdup");
5364
5365	TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor,do { (loadanchor)->entries.tqe_next = ((void )0); (loadanchor )->entries.tqe_prev = (&loadanchorshead)->tqh_last; (&loadanchorshead)->tqh_last = (loadanchor); (&loadanchorshead )->tqh_last = &(loadanchor)->entries.tqe_next; } while (0)
5366	entries)do { (loadanchor)->entries.tqe_next = ((void )0); (loadanchor )->entries.tqe_prev = (&loadanchorshead)->tqh_last; (&loadanchorshead)->tqh_last = (loadanchor); (&loadanchorshead )->tqh_last = &(loadanchor)->entries.tqe_next; } while (0);
5367
5368	free(yyvsp[-2].v.string);
5369	free(yyvsp[0].v.string);
5370	}
5371	break;
5372	case 68:
5373	#line 1013 "/usr/src/sbin/pfctl/parse.y"
5374	{
5375	bzero(&scrub_opts, sizeof scrub_opts);
5376	}
5377	break;
5378	case 69:
5379	#line 1017 "/usr/src/sbin/pfctl/parse.y"
5380	{ yyval.v.scrub_opts = scrub_opts; }
5381	break;
5382	case 72:
5383	#line 1024 "/usr/src/sbin/pfctl/parse.y"
5384	{
5385	if (scrub_opts.nodf) {
5386	yyerror("no-df cannot be respecified");
5387	YYERRORgoto yyerrlab;
5388	}
5389	scrub_opts.nodf = 1;
5390	}
5391	break;
5392	case 73:
5393	#line 1031 "/usr/src/sbin/pfctl/parse.y"
5394	{
5395	if (scrub_opts.marker & FOM_MINTTL0x0020) {
5396	yyerror("min-ttl cannot be respecified");
5397	YYERRORgoto yyerrlab;
5398	}
5399	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > 255) {
5400	yyerror("illegal min-ttl value %lld", yyvsp[0].v.number);
5401	YYERRORgoto yyerrlab;
5402	}
5403	scrub_opts.marker \|= FOM_MINTTL0x0020;
5404	scrub_opts.minttl = yyvsp[0].v.number;
5405	}
5406	break;
5407	case 74:
5408	#line 1043 "/usr/src/sbin/pfctl/parse.y"
5409	{
5410	if (scrub_opts.marker & FOM_MAXMSS0x0040) {
5411	yyerror("max-mss cannot be respecified");
5412	YYERRORgoto yyerrlab;
5413	}
5414	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > 65535) {
5415	yyerror("illegal max-mss value %lld", yyvsp[0].v.number);
5416	YYERRORgoto yyerrlab;
5417	}
5418	scrub_opts.marker \|= FOM_MAXMSS0x0040;
5419	scrub_opts.maxmss = yyvsp[0].v.number;
5420	}
5421	break;
5422	case 75:
5423	#line 1055 "/usr/src/sbin/pfctl/parse.y"
5424	{
5425	if (strcasecmp(yyvsp[0].v.string, "tcp") != 0) {
5426	yyerror("scrub reassemble supports only tcp, "
5427	"not '%s'", yyvsp[0].v.string);
5428	free(yyvsp[0].v.string);
5429	YYERRORgoto yyerrlab;
5430	}
5431	free(yyvsp[0].v.string);
5432	if (scrub_opts.reassemble_tcp) {
5433	yyerror("reassemble tcp cannot be respecified");
5434	YYERRORgoto yyerrlab;
5435	}
5436	scrub_opts.reassemble_tcp = 1;
5437	}
5438	break;
5439	case 76:
5440	#line 1069 "/usr/src/sbin/pfctl/parse.y"
5441	{
5442	if (scrub_opts.randomid) {
5443	yyerror("random-id cannot be respecified");
5444	YYERRORgoto yyerrlab;
5445	}
5446	scrub_opts.randomid = 1;
5447	}
5448	break;
5449	case 77:
5450	#line 1078 "/usr/src/sbin/pfctl/parse.y"
5451	{
5452	struct pf_rule r;
5453	struct node_host h = NULL((void )0), *hh;
5454	struct node_if i, j;
5455
5456	for (i = yyvsp[-2].v.interface; i; i = i->next) {
5457	bzero(&r, sizeof(r));
5458
5459	r.action = PF_DROP;
5460	r.direction = PF_IN;
5461	r.log = yyvsp[-3].v.logquick.log;
5462	r.logif = yyvsp[-3].v.logquick.logif;
5463	r.quick = yyvsp[-3].v.logquick.quick;
5464	r.af = yyvsp[-1].v.i;
5465	if (rule_label(&r, yyvsp[0].v.antispoof_opts.label))
5466	YYERRORgoto yyerrlab;
5467	r.rtableid = yyvsp[0].v.antispoof_opts.rtableid;
5468	j = calloc(1, sizeof(struct node_if));
5469	if (j == NULL((void *)0))
5470	err(1, "antispoof: calloc");
5471	if (strlcpy(j->ifname, i->ifname,
5472	sizeof(j->ifname)) >= sizeof(j->ifname)) {
5473	free(j);
5474	yyerror("interface name too long");
5475	YYERRORgoto yyerrlab;
5476	}
5477	j->not = 1;
5478	if (i->dynamic) {
5479	h = calloc(1, sizeof(*h));
5480	if (h == NULL((void *)0))
5481	err(1, "address: calloc");
5482	h->addr.type = PF_ADDR_DYNIFTL;
5483	set_ipmask(h, 128);
5484	if (strlcpy(h->addr.v.ifname, i->ifname,
5485	sizeof(h->addr.v.ifname)) >=
5486	sizeof(h->addr.v.ifname)) {
5487	free(h);
5488	yyerror(
5489	"interface name too long");
5490	YYERRORgoto yyerrlab;
5491	}
5492	hh = malloc(sizeof(*hh));
5493	if (hh == NULL((void *)0))
5494	err(1, "address: malloc");
5495	bcopy(h, hh, sizeof(*hh));
5496	h->addr.iflags = PFI_AFLAG_NETWORK0x01;
5497	} else {
5498	h = ifa_lookup(j->ifname,
5499	PFI_AFLAG_NETWORK0x01);
5500	hh = NULL((void *)0);
5501	}
5502
5503	if (h != NULL((void *)0))
5504	expand_rule(&r, 0, j, NULL((void )0), NULL((void )0), NULL((void *)0),
5505	NULL((void )0), NULL((void )0), h, NULL((void )0), NULL((void )0), NULL((void *)0),
5506	NULL((void )0), NULL((void )0), NULL((void )0), NULL((void )0));
5507
5508	if ((i->ifa_flags & IFF_LOOPBACK0x8) == 0) {
5509	bzero(&r, sizeof(r));
5510
5511	r.action = PF_DROP;
5512	r.direction = PF_IN;
5513	r.log = yyvsp[-3].v.logquick.log;
5514	r.logif = yyvsp[-3].v.logquick.logif;
5515	r.quick = yyvsp[-3].v.logquick.quick;
5516	r.af = yyvsp[-1].v.i;
5517	if (rule_label(&r, yyvsp[0].v.antispoof_opts.label))
5518	YYERRORgoto yyerrlab;
5519	r.rtableid = yyvsp[0].v.antispoof_opts.rtableid;
5520	if (hh != NULL((void *)0))
5521	h = hh;
5522	else
5523	h = ifa_lookup(i->ifname, 0);
5524	if (h != NULL((void *)0))
5525	expand_rule(&r, 0, NULL((void )0), NULL((void )0),
5526	NULL((void )0), NULL((void )0), NULL((void )0), NULL((void )0), h,
5527	NULL((void )0), NULL((void )0), NULL((void )0), NULL((void )0),
5528	NULL((void )0), NULL((void )0), NULL((void *)0));
5529	} else
5530	free(hh);
5531	}
5532	free(yyvsp[0].v.antispoof_opts.label);
5533	}
5534	break;
5535	case 78:
5536	#line 1163 "/usr/src/sbin/pfctl/parse.y"
5537	{ yyval.v.interface = yyvsp[0].v.interface; }
5538	break;
5539	case 79:
5540	#line 1164 "/usr/src/sbin/pfctl/parse.y"
5541	{ yyval.v.interface = yyvsp[-1].v.interface; }
5542	break;
5543	case 80:
5544	#line 1167 "/usr/src/sbin/pfctl/parse.y"
5545	{ yyval.v.interface = yyvsp[-1].v.interface; }
5546	break;
5547	case 81:
5548	#line 1168 "/usr/src/sbin/pfctl/parse.y"
5549	{
5550	yyvsp[-3].v.interface->tail->next = yyvsp[-1].v.interface;
5551	yyvsp[-3].v.interface->tail = yyvsp[-1].v.interface;
5552	yyval.v.interface = yyvsp[-3].v.interface;
5553	}
5554	break;
5555	case 82:
5556	#line 1175 "/usr/src/sbin/pfctl/parse.y"
5557	{ yyval.v.interface = yyvsp[0].v.interface; }
5558	break;
5559	case 83:
5560	#line 1176 "/usr/src/sbin/pfctl/parse.y"
5561	{
5562	yyvsp[-1].v.interface->dynamic = 1;
5563	yyval.v.interface = yyvsp[-1].v.interface;
5564	}
5565	break;
5566	case 84:
5567	#line 1182 "/usr/src/sbin/pfctl/parse.y"
5568	{
5569	bzero(&antispoof_opts, sizeof antispoof_opts);
5570	antispoof_opts.rtableid = -1;
5571	}
5572	break;
5573	case 85:
5574	#line 1187 "/usr/src/sbin/pfctl/parse.y"
5575	{ yyval.v.antispoof_opts = antispoof_opts; }
5576	break;
5577	case 86:
5578	#line 1188 "/usr/src/sbin/pfctl/parse.y"
5579	{
5580	bzero(&antispoof_opts, sizeof antispoof_opts);
5581	antispoof_opts.rtableid = -1;
5582	yyval.v.antispoof_opts = antispoof_opts;
5583	}
5584	break;
5585	case 89:
5586	#line 1199 "/usr/src/sbin/pfctl/parse.y"
5587	{
5588	if (antispoof_opts.label) {
5589	yyerror("label cannot be redefined");
5590	YYERRORgoto yyerrlab;
5591	}
5592	antispoof_opts.label = yyvsp[0].v.string;
5593	}
5594	break;
5595	case 90:
5596	#line 1206 "/usr/src/sbin/pfctl/parse.y"
5597	{
5598	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > RT_TABLEID_MAX255) {
5599	yyerror("invalid rtable id");
5600	YYERRORgoto yyerrlab;
5601	} else if (!lookup_rtable(yyvsp[0].v.number)) {
5602	yyerror("rtable %lld does not exist", yyvsp[0].v.number);
5603	YYERRORgoto yyerrlab;
5604	}
5605	antispoof_opts.rtableid = yyvsp[0].v.number;
5606	}
5607	break;
5608	case 91:
5609	#line 1218 "/usr/src/sbin/pfctl/parse.y"
5610	{ yyval.v.number = 1; }
5611	break;
5612	case 92:
5613	#line 1219 "/usr/src/sbin/pfctl/parse.y"
5614	{ yyval.v.number = 0; }
5615	break;
5616	case 93:
5617	#line 1222 "/usr/src/sbin/pfctl/parse.y"
5618	{
5619	struct node_host h, nh;
5620	struct node_tinit ti, nti;
5621
5622	if (strlen(yyvsp[-2].v.string) >= PF_TABLE_NAME_SIZE32) {
5623	yyerror("table name too long, max %d chars",
5624	PF_TABLE_NAME_SIZE32 - 1);
5625	free(yyvsp[-2].v.string);
5626	YYERRORgoto yyerrlab;
5627	}
5628	if (process_tabledef(yyvsp[-2].v.string, &yyvsp[0].v.table_opts, pf->opts)) {
5629	free(yyvsp[-2].v.string);
5630	YYERRORgoto yyerrlab;
5631	}
5632	free(yyvsp[-2].v.string);
5633	for (ti = SIMPLEQ_FIRST(&yyvsp[0].v.table_opts.init_nodes)((&yyvsp[0].v.table_opts.init_nodes)->sqh_first); ti != NULL((void *)0);
5634	ti = nti) {
5635	if (ti->file)
5636	free(ti->file);
5637	for (h = ti->host; h != NULL((void *)0); h = nh) {
5638	nh = h->next;
5639	free(h);
5640	}
5641	nti = SIMPLEQ_NEXT(ti, entries)((ti)->entries.sqe_next);
5642	free(ti);
5643	}
5644	}
5645	break;
5646	case 94:
5647	#line 1251 "/usr/src/sbin/pfctl/parse.y"
5648	{
5649	bzero(&table_opts, sizeof table_opts);
5650	SIMPLEQ_INIT(&table_opts.init_nodes)do { (&table_opts.init_nodes)->sqh_first = ((void *)0) ; (&table_opts.init_nodes)->sqh_last = &(&table_opts .init_nodes)->sqh_first; } while (0);
5651	}
5652	break;
5653	case 95:
5654	#line 1256 "/usr/src/sbin/pfctl/parse.y"
5655	{ yyval.v.table_opts = table_opts; }
5656	break;
5657	case 96:
5658	#line 1258 "/usr/src/sbin/pfctl/parse.y"
5659	{
5660	bzero(&table_opts, sizeof table_opts);
5661	SIMPLEQ_INIT(&table_opts.init_nodes)do { (&table_opts.init_nodes)->sqh_first = ((void *)0) ; (&table_opts.init_nodes)->sqh_last = &(&table_opts .init_nodes)->sqh_first; } while (0);
5662	yyval.v.table_opts = table_opts;
5663	}
5664	break;
5665	case 99:
5666	#line 1269 "/usr/src/sbin/pfctl/parse.y"
5667	{
5668	if (!strcmp(yyvsp[0].v.string, "const"))
5669	table_opts.flags \|= PFR_TFLAG_CONST0x00000002;
5670	else if (!strcmp(yyvsp[0].v.string, "persist"))
5671	table_opts.flags \|= PFR_TFLAG_PERSIST0x00000001;
5672	else if (!strcmp(yyvsp[0].v.string, "counters"))
5673	table_opts.flags \|= PFR_TFLAG_COUNTERS0x00000040;
5674	else {
5675	yyerror("invalid table option '%s'", yyvsp[0].v.string);
5676	free(yyvsp[0].v.string);
5677	YYERRORgoto yyerrlab;
5678	}
5679	free(yyvsp[0].v.string);
5680	}
5681	break;
5682	case 100:
5683	#line 1283 "/usr/src/sbin/pfctl/parse.y"
5684	{ table_opts.init_addr = 1; }
5685	break;
5686	case 101:
5687	#line 1284 "/usr/src/sbin/pfctl/parse.y"
5688	{
5689	struct node_host *n;
5690	struct node_tinit *ti;
5691
5692	for (n = yyvsp[-1].v.host; n != NULL((void *)0); n = n->next) {
5693	switch (n->addr.type) {
5694	case PF_ADDR_ADDRMASK:
5695	continue; /* ok */
5696	case PF_ADDR_RANGE:
5697	yyerror("address ranges are not "
5698	"permitted inside tables");
5699	break;
5700	case PF_ADDR_DYNIFTL:
5701	yyerror("dynamic addresses are not "
5702	"permitted inside tables");
5703	break;
5704	case PF_ADDR_TABLE:
5705	yyerror("tables cannot contain tables");
5706	break;
5707	case PF_ADDR_NOROUTE:
5708	yyerror("\"no-route\" is not permitted "
5709	"inside tables");
5710	break;
5711	case PF_ADDR_URPFFAILED:
5712	yyerror("\"urpf-failed\" is not "
5713	"permitted inside tables");
5714	break;
5715	default:
5716	yyerror("unknown address type %d",
5717	n->addr.type);
5718	}
5719	YYERRORgoto yyerrlab;
5720	}
5721	if (!(ti = calloc(1, sizeof(*ti))))
5722	err(1, "table_opt: calloc");
5723	ti->host = yyvsp[-1].v.host;
5724	SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,do { (ti)->entries.sqe_next = ((void )0); (&table_opts .init_nodes)->sqh_last = (ti); (&table_opts.init_nodes )->sqh_last = &(ti)->entries.sqe_next; } while (0)
5725	entries)do { (ti)->entries.sqe_next = ((void )0); (&table_opts .init_nodes)->sqh_last = (ti); (&table_opts.init_nodes )->sqh_last = &(ti)->entries.sqe_next; } while (0);
5726	table_opts.init_addr = 1;
5727	}
5728	break;
5729	case 102:
5730	#line 1324 "/usr/src/sbin/pfctl/parse.y"
5731	{
5732	struct node_tinit *ti;
5733
5734	if (!(ti = calloc(1, sizeof(*ti))))
5735	err(1, "table_opt: calloc");
5736	ti->file = yyvsp[0].v.string;
5737	SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,do { (ti)->entries.sqe_next = ((void )0); (&table_opts .init_nodes)->sqh_last = (ti); (&table_opts.init_nodes )->sqh_last = &(ti)->entries.sqe_next; } while (0)
5738	entries)do { (ti)->entries.sqe_next = ((void )0); (&table_opts .init_nodes)->sqh_last = (ti); (&table_opts.init_nodes )->sqh_last = &(ti)->entries.sqe_next; } while (0);
5739	table_opts.init_addr = 1;
5740	}
5741	break;
5742	case 103:
5743	#line 1336 "/usr/src/sbin/pfctl/parse.y"
5744	{
5745	if (yyvsp[0].v.weight > 0) {
5746	struct node_host *n;
5747	for (n = yyvsp[-1].v.host; n != NULL((void *)0); n = n->next)
5748	n->weight = yyvsp[0].v.weight;
5749	}
5750	yyval.v.host = yyvsp[-1].v.host;
5751	}
5752	break;
5753	case 104:
5754	#line 1344 "/usr/src/sbin/pfctl/parse.y"
5755	{ yyval.v.host = yyvsp[-1].v.host; }
5756	break;
5757	case 105:
5758	#line 1347 "/usr/src/sbin/pfctl/parse.y"
5759	{ yyval.v.host = yyvsp[-1].v.host; }
5760	break;
5761	case 106:
5762	#line 1348 "/usr/src/sbin/pfctl/parse.y"
5763	{
5764	yyvsp[-3].v.host->tail->next = yyvsp[-1].v.host;
5765	yyvsp[-3].v.host->tail = yyvsp[-1].v.host->tail;
5766	yyval.v.host = yyvsp[-3].v.host;
5767	}
5768	break;
5769	case 107:
5770	#line 1355 "/usr/src/sbin/pfctl/parse.y"
5771	{
5772	struct node_host *n;
5773
5774	if (yyvsp[-1].v.interface == NULL((void )0) && yyvsp[0].v.queue_opts.parent == NULL((void )0)) {
5775	yyerror("root queue without interface");
5776	YYERRORgoto yyerrlab;
5777	}
5778	if (yyvsp[-1].v.interface != NULL((void *)0) &&
5779	((n = ifa_exists(yyvsp[-1].v.interface->ifname)) == NULL((void *)0) \|\|
5780	n->af != AF_LINK18)) {
5781	yyerror("not an interface");
5782	YYERRORgoto yyerrlab;
5783	}
5784
5785	expand_queue(yyvsp[-2].v.string, yyvsp[-1].v.interface, &yyvsp[0].v.queue_opts);
5786	}
5787	break;
5788	case 108:
5789	#line 1373 "/usr/src/sbin/pfctl/parse.y"
5790	{
5791	bzero(&queue_opts, sizeof queue_opts);
5792	}
5793	break;
5794	case 109:
5795	#line 1377 "/usr/src/sbin/pfctl/parse.y"
5796	{ yyval.v.queue_opts = queue_opts; }
5797	break;
5798	case 112:
5799	#line 1384 "/usr/src/sbin/pfctl/parse.y"
5800	{
5801	if (queue_opts.marker & QOM_BWSPEC0x01) {
5802	yyerror("bandwidth cannot be respecified");
5803	YYERRORgoto yyerrlab;
5804	}
5805	queue_opts.marker \|= QOM_BWSPEC0x01;
5806	queue_opts.linkshare = yyvsp[-1].v.sc;
5807	queue_opts.realtime= yyvsp[0].v.queue_opts.realtime;
5808	queue_opts.upperlimit = yyvsp[0].v.queue_opts.upperlimit;
5809	}
5810	break;
5811	case 113:
5812	#line 1394 "/usr/src/sbin/pfctl/parse.y"
5813	{
5814	if (queue_opts.marker & QOM_PARENT0x02) {
5815	yyerror("parent cannot be respecified");
5816	YYERRORgoto yyerrlab;
5817	}
5818	queue_opts.marker \|= QOM_PARENT0x02;
5819	queue_opts.parent = yyvsp[0].v.string;
5820	}
5821	break;
5822	case 114:
5823	#line 1402 "/usr/src/sbin/pfctl/parse.y"
5824	{
5825	if (queue_opts.marker & QOM_DEFAULT0x04) {
5826	yyerror("default cannot be respecified");
5827	YYERRORgoto yyerrlab;
5828	}
5829	queue_opts.marker \|= QOM_DEFAULT0x04;
5830	queue_opts.flags \|= PFQS_DEFAULT0x1000;
5831	}
5832	break;
5833	case 115:
5834	#line 1410 "/usr/src/sbin/pfctl/parse.y"
5835	{
5836	if (queue_opts.marker & QOM_QLIMIT0x08) {
5837	yyerror("qlimit cannot be respecified");
5838	YYERRORgoto yyerrlab;
5839	}
5840	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > 65535) {
5841	yyerror("qlimit out of range: max 65535");
5842	YYERRORgoto yyerrlab;
5843	}
5844	queue_opts.marker \|= QOM_QLIMIT0x08;
5845	queue_opts.qlimit = yyvsp[0].v.number;
5846	}
5847	break;
5848	case 116:
5849	#line 1422 "/usr/src/sbin/pfctl/parse.y"
5850	{
5851	if (queue_opts.marker & QOM_FLOWS0x10) {
5852	yyerror("number of flows cannot be respecified");
5853	YYERRORgoto yyerrlab;
5854	}
5855	if (yyvsp[0].v.number < 1 \|\| yyvsp[0].v.number > 32767) {
5856	yyerror("number of flows out of range: "
5857	"max 32767");
5858	YYERRORgoto yyerrlab;
5859	}
5860	queue_opts.marker \|= QOM_FLOWS0x10;
5861	queue_opts.flags \|= PFQS_FLOWQUEUE0x0001;
5862	queue_opts.flowqueue.flows = yyvsp[0].v.number;
5863	}
5864	break;
5865	case 117:
5866	#line 1436 "/usr/src/sbin/pfctl/parse.y"
5867	{
5868	if (queue_opts.marker & QOM_QUANTUM0x20) {
5869	yyerror("quantum cannot be respecified");
5870	YYERRORgoto yyerrlab;
5871	}
5872	if (yyvsp[0].v.number < 1 \|\| yyvsp[0].v.number > 65535) {
5873	yyerror("quantum out of range: max 65535");
5874	YYERRORgoto yyerrlab;
5875	}
5876	queue_opts.marker \|= QOM_QUANTUM0x20;
5877	queue_opts.flowqueue.quantum = yyvsp[0].v.number;
5878	}
5879	break;
5880	case 118:
5881	#line 1450 "/usr/src/sbin/pfctl/parse.y"
5882	{
5883
5884	}
5885	break;
5886	case 119:
5887	#line 1453 "/usr/src/sbin/pfctl/parse.y"
5888	{
5889	yyval.v.queue_opts.realtime = yyvsp[0].v.sc;
5890	}
5891	break;
5892	case 120:
5893	#line 1456 "/usr/src/sbin/pfctl/parse.y"
5894	{
5895	yyval.v.queue_opts.upperlimit = yyvsp[0].v.sc;
5896	}
5897	break;
5898	case 121:
5899	#line 1459 "/usr/src/sbin/pfctl/parse.y"
5900	{
5901	yyval.v.queue_opts.realtime = yyvsp[-3].v.sc;
5902	yyval.v.queue_opts.upperlimit = yyvsp[0].v.sc;
5903	}
5904	break;
5905	case 122:
5906	#line 1463 "/usr/src/sbin/pfctl/parse.y"
5907	{
5908	yyval.v.queue_opts.realtime = yyvsp[0].v.sc;
5909	yyval.v.queue_opts.upperlimit = yyvsp[-3].v.sc;
5910	}
5911	break;
5912	case 123:
5913	#line 1469 "/usr/src/sbin/pfctl/parse.y"
5914	{
5915	yyval.v.sc.m2 = yyvsp[0].v.queue_bwspec;
5916	yyval.v.sc.d = 0;
5917	if (yyval.v.sc.m2.bw_percent) {
5918	yyerror("no bandwidth in %% yet");
5919	YYERRORgoto yyerrlab;
5920	}
5921	}
5922	break;
5923	case 124:
5924	#line 1477 "/usr/src/sbin/pfctl/parse.y"
5925	{
5926	u_long ul;
5927	char *cp;
5928
5929	ul = strtoul(yyvsp[0].v.string, &cp, 10);
5930	if (cp == NULL((void *)0) \|\| strcmp(cp, "ms")) {
5931	yyerror("time in scspec must be in ms");
5932	YYERRORgoto yyerrlab;
5933	}
5934
5935	yyval.v.sc.m1 = yyvsp[-2].v.queue_bwspec;
5936	yyval.v.sc.d = ul;
5937	yyval.v.sc.m2 = yyvsp[-4].v.queue_bwspec;
5938
5939	if (yyval.v.sc.m1.bw_percent \|\| yyval.v.sc.m2.bw_percent) {
5940	yyerror("no bandwidth in %% yet");
5941	YYERRORgoto yyerrlab;
5942	}
5943	}
5944	break;
5945	case 125:
5946	#line 1498 "/usr/src/sbin/pfctl/parse.y"
5947	{
5948	double bps;
5949	char *cp;
5950
5951	yyval.v.queue_bwspec.bw_percent = 0;
5952
5953	bps = strtod(yyvsp[0].v.string, &cp);
5954	if (cp != NULL((void *)0)) {
5955	if (strlen(cp) > 1) {
5956	char *cu = cp + 1;
5957	if (!strcmp(cu, "Bit") \|\|
5958	!strcmp(cu, "B") \|\|
5959	!strcmp(cu, "bit") \|\|
5960	!strcmp(cu, "b")) {
5961	*cu = 0;
5962	}
5963	}
5964	if (!strcmp(cp, "b"))
5965	; /* nothing */
5966	else if (!strcmp(cp, "K"))
5967	bps *= 1000;
5968	else if (!strcmp(cp, "M"))
5969	bps = 1000 1000;
5970	else if (!strcmp(cp, "G"))
5971	bps = 1000 1000 * 1000;
5972	else if (!strcmp(cp, "%")) {
5973	if (bps < 0 \|\| bps > 100) {
5974	yyerror("bandwidth spec "
5975	"out of range");
5976	free(yyvsp[0].v.string);
5977	YYERRORgoto yyerrlab;
5978	}
5979	yyval.v.queue_bwspec.bw_percent = bps;
5980	bps = 0;
5981	} else {
5982	yyerror("unknown unit \"%s\"", cp);
5983	free(yyvsp[0].v.string);
5984	YYERRORgoto yyerrlab;
5985	}
5986	}
5987	free(yyvsp[0].v.string);
5988	yyval.v.queue_bwspec.bw_absolute = (u_int32_t)bps;
5989	}
5990	break;
5991	case 126:
5992	#line 1541 "/usr/src/sbin/pfctl/parse.y"
5993	{
5994	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > UINT_MAX0xffffffffU) {
5995	yyerror("bandwidth number too big");
5996	YYERRORgoto yyerrlab;
5997	}
5998	yyval.v.queue_bwspec.bw_percent = 0;
5999	yyval.v.queue_bwspec.bw_absolute = yyvsp[0].v.number;
6000	}
6001	break;
6002	case 127:
6003	#line 1553 "/usr/src/sbin/pfctl/parse.y"
6004	{
6005	struct pf_rule r;
6006	struct node_state_opt *o;
6007	struct node_proto *proto;
6008	int srctrack = 0;
6009	int statelock = 0;
6010	int adaptive = 0;
6011	int defaults = 0;
6012
6013	memset(&r, 0, sizeof(r));
6014	r.action = yyvsp[-7].v.b.b1;
6015	switch (yyvsp[-7].v.b.b2) {
6016	case PFRULE_RETURNRST0x0001:
6017	r.rule_flag \|= PFRULE_RETURNRST0x0001;
6018	r.return_ttl = yyvsp[-7].v.b.w;
6019	break;
6020	case PFRULE_RETURNICMP0x0004:
6021	r.rule_flag \|= PFRULE_RETURNICMP0x0004;
6022	r.return_icmp = yyvsp[-7].v.b.w;
6023	r.return_icmp6 = yyvsp[-7].v.b.w2;
6024	break;
6025	case PFRULE_RETURN0x0008:
6026	r.rule_flag \|= PFRULE_RETURN0x0008;
6027	r.return_icmp = yyvsp[-7].v.b.w;
6028	r.return_icmp6 = yyvsp[-7].v.b.w2;
6029	break;
6030	}
6031	r.direction = yyvsp[-6].v.i;
6032	r.log = yyvsp[-5].v.logquick.log;
6033	r.logif = yyvsp[-5].v.logquick.logif;
6034	r.quick = yyvsp[-5].v.logquick.quick;
6035	r.af = yyvsp[-3].v.i;
6036
6037	if (filteropts_to_rule(&r, &yyvsp[0].v.filter_opts))
6038	YYERRORgoto yyerrlab;
6039
6040	if (yyvsp[0].v.filter_opts.flags.b1 \|\| yyvsp[0].v.filter_opts.flags.b2 \|\| yyvsp[-1].v.fromto.src_os) {
6041	for (proto = yyvsp[-2].v.proto; proto != NULL((void *)0) &&
6042	proto->proto != IPPROTO_TCP6;
6043	proto = proto->next)
6044	; /* nothing */
6045	if (proto == NULL((void )0) && yyvsp[-2].v.proto != NULL((void )0)) {
6046	if (yyvsp[0].v.filter_opts.flags.b1 \|\| yyvsp[0].v.filter_opts.flags.b2)
6047	yyerror(
6048	"flags only apply to tcp");
6049	if (yyvsp[-1].v.fromto.src_os)
6050	yyerror(
6051	"OS fingerprinting only "
6052	"apply to tcp");
6053	YYERRORgoto yyerrlab;
6054	}
6055	}
6056
6057	r.keep_state = yyvsp[0].v.filter_opts.keep.action;
6058	o = yyvsp[0].v.filter_opts.keep.options;
6059
6060	/* 'keep state' by default on pass rules. */
6061	if (!r.keep_state && !r.action &&
6062	!(yyvsp[0].v.filter_opts.marker & FOM_KEEP0x0008)) {
6063	r.keep_state = PF_STATE_NORMAL0x1;
6064	o = keep_state_defaults;
6065	defaults = 1;
6066	}
6067
6068	while (o) {
6069	struct node_state_opt *p = o;
6070
6071	switch (o->type) {
6072	case PF_STATE_OPT_MAX:
6073	if (r.max_states) {
6074	yyerror("state option 'max' "
6075	"multiple definitions");
6076	YYERRORgoto yyerrlab;
6077	}
6078	r.max_states = o->data.max_states;
6079	break;
6080	case PF_STATE_OPT_NOSYNC:
6081	if (r.rule_flag & PFRULE_NOSYNC0x0010) {
6082	yyerror("state option 'sync' "
6083	"multiple definitions");
6084	YYERRORgoto yyerrlab;
6085	}
6086	r.rule_flag \|= PFRULE_NOSYNC0x0010;
6087	break;
6088	case PF_STATE_OPT_SRCTRACK:
6089	if (srctrack) {
6090	yyerror("state option "
6091	"'source-track' "
6092	"multiple definitions");
6093	YYERRORgoto yyerrlab;
6094	}
6095	srctrack = o->data.src_track;
6096	r.rule_flag \|= PFRULE_SRCTRACK0x0020;
6097	break;
6098	case PF_STATE_OPT_MAX_SRC_STATES:
6099	if (r.max_src_states) {
6100	yyerror("state option "
6101	"'max-src-states' "
6102	"multiple definitions");
6103	YYERRORgoto yyerrlab;
6104	}
6105	if (o->data.max_src_states == 0) {
6106	yyerror("'max-src-states' must "
6107	"be > 0");
6108	YYERRORgoto yyerrlab;
6109	}
6110	r.max_src_states =
6111	o->data.max_src_states;
6112	r.rule_flag \|= PFRULE_SRCTRACK0x0020;
6113	break;
6114	case PF_STATE_OPT_OVERLOAD:
6115	if (r.overload_tblname[0]) {
6116	yyerror("multiple 'overload' "
6117	"table definitions");
6118	YYERRORgoto yyerrlab;
6119	}
6120	if (strlcpy(r.overload_tblname,
6121	o->data.overload.tblname,
6122	PF_TABLE_NAME_SIZE32) >=
6123	PF_TABLE_NAME_SIZE32) {
6124	yyerror("state option: "
6125	"strlcpy");
6126	YYERRORgoto yyerrlab;
6127	}
6128	r.flush = o->data.overload.flush;
6129	break;
6130	case PF_STATE_OPT_MAX_SRC_CONN:
6131	if (r.max_src_conn) {
6132	yyerror("state option "
6133	"'max-src-conn' "
6134	"multiple definitions");
6135	YYERRORgoto yyerrlab;
6136	}
6137	if (o->data.max_src_conn == 0) {
6138	yyerror("'max-src-conn' "
6139	"must be > 0");
6140	YYERRORgoto yyerrlab;
6141	}
6142	r.max_src_conn =
6143	o->data.max_src_conn;
6144	r.rule_flag \|= PFRULE_SRCTRACK0x0020 \|
6145	PFRULE_RULESRCTRACK0x0040;
6146	break;
6147	case PF_STATE_OPT_MAX_SRC_CONN_RATE:
6148	if (r.max_src_conn_rate.limit) {
6149	yyerror("state option "
6150	"'max-src-conn-rate' "
6151	"multiple definitions");
6152	YYERRORgoto yyerrlab;
6153	}
6154	if (!o->data.max_src_conn_rate.limit \|\|
6155	!o->data.max_src_conn_rate.seconds) {
6156	yyerror("'max-src-conn-rate' "
6157	"values must be > 0");
6158	YYERRORgoto yyerrlab;
6159	}
6160	if (o->data.max_src_conn_rate.limit >
6161	PF_THRESHOLD_MAX0xffffffff / 1000) {
6162	yyerror("'max-src-conn-rate' "
6163	"maximum rate must be < %u",
6164	PF_THRESHOLD_MAX0xffffffff / 1000);
6165	YYERRORgoto yyerrlab;
6166	}
6167	r.max_src_conn_rate.limit =
6168	o->data.max_src_conn_rate.limit;
6169	r.max_src_conn_rate.seconds =
6170	o->data.max_src_conn_rate.seconds;
6171	r.rule_flag \|= PFRULE_SRCTRACK0x0020 \|
6172	PFRULE_RULESRCTRACK0x0040;
6173	break;
6174	case PF_STATE_OPT_MAX_SRC_NODES:
6175	if (r.max_src_nodes) {
6176	yyerror("state option "
6177	"'max-src-nodes' "
6178	"multiple definitions");
6179	YYERRORgoto yyerrlab;
6180	}
6181	if (o->data.max_src_nodes == 0) {
6182	yyerror("'max-src-nodes' must "
6183	"be > 0");
6184	YYERRORgoto yyerrlab;
6185	}
6186	r.max_src_nodes =
6187	o->data.max_src_nodes;
6188	r.rule_flag \|= PFRULE_SRCTRACK0x0020 \|
6189	PFRULE_RULESRCTRACK0x0040;
6190	break;
6191	case PF_STATE_OPT_STATELOCK:
6192	if (statelock) {
6193	yyerror("state locking option: "
6194	"multiple definitions");
6195	YYERRORgoto yyerrlab;
6196	}
6197	statelock = 1;
6198	r.rule_flag \|= o->data.statelock;
6199	break;
6200	case PF_STATE_OPT_SLOPPY:
6201	if (r.rule_flag & PFRULE_STATESLOPPY0x00020000) {
6202	yyerror("state sloppy option: "
6203	"multiple definitions");
6204	YYERRORgoto yyerrlab;
6205	}
6206	r.rule_flag \|= PFRULE_STATESLOPPY0x00020000;
6207	break;
6208	case PF_STATE_OPT_PFLOW:
6209	if (r.rule_flag & PFRULE_PFLOW0x00040000) {
6210	yyerror("state pflow "
6211	"option: multiple "
6212	"definitions");
6213	YYERRORgoto yyerrlab;
6214	}
6215	r.rule_flag \|= PFRULE_PFLOW0x00040000;
6216	break;
6217	case PF_STATE_OPT_TIMEOUT:
6218	if (o->data.timeout.number ==
6219	PFTM_ADAPTIVE_START \|\|
6220	o->data.timeout.number ==
6221	PFTM_ADAPTIVE_END)
6222	adaptive = 1;
6223	if (r.timeout[o->data.timeout.number]) {
6224	yyerror("state timeout %s "
6225	"multiple definitions",
6226	pf_timeouts[o->data.
6227	timeout.number].name);
6228	YYERRORgoto yyerrlab;
6229	}
6230	r.timeout[o->data.timeout.number] =
6231	o->data.timeout.seconds;
6232	}
6233	o = o->next;
6234	if (!defaults)
6235	free(p);
6236	}
6237
6238	/* 'flags S/SA' by default on stateful rules */
6239	if (!r.action && !r.flags && !r.flagset &&
6240	!yyvsp[0].v.filter_opts.fragment && !(yyvsp[0].v.filter_opts.marker & FOM_FLAGS0x0001) &&
6241	r.keep_state) {
6242	r.flags = parse_flags("S");
6243	r.flagset = parse_flags("SA");
6244	}
6245	if (!adaptive && r.max_states) {
6246	r.timeout[PFTM_ADAPTIVE_START] =
6247	(r.max_states / 10) * 6;
6248	r.timeout[PFTM_ADAPTIVE_END] =
6249	(r.max_states / 10) * 12;
6250	}
6251	if (r.rule_flag & PFRULE_SRCTRACK0x0020) {
6252	if (srctrack == PF_SRCTRACK_GLOBAL &&
6253	r.max_src_nodes) {
6254	yyerror("'max-src-nodes' is "
6255	"incompatible with "
6256	"'source-track global'");
6257	YYERRORgoto yyerrlab;
6258	}
6259	if (srctrack == PF_SRCTRACK_GLOBAL &&
6260	r.max_src_conn) {
6261	yyerror("'max-src-conn' is "
6262	"incompatible with "
6263	"'source-track global'");
6264	YYERRORgoto yyerrlab;
6265	}
6266	if (srctrack == PF_SRCTRACK_GLOBAL &&
6267	r.max_src_conn_rate.seconds) {
6268	yyerror("'max-src-conn-rate' is "
6269	"incompatible with "
6270	"'source-track global'");
6271	YYERRORgoto yyerrlab;
6272	}
6273	if (r.timeout[PFTM_SRC_NODE] <
6274	r.max_src_conn_rate.seconds)
6275	r.timeout[PFTM_SRC_NODE] =
6276	r.max_src_conn_rate.seconds;
6277	r.rule_flag \|= PFRULE_SRCTRACK0x0020;
6278	if (srctrack == PF_SRCTRACK_RULE)
6279	r.rule_flag \|= PFRULE_RULESRCTRACK0x0040;
6280	}
6281	if (r.keep_state && !statelock)
6282	r.rule_flag \|= default_statelock;
6283
6284	decide_address_family(yyvsp[-1].v.fromto.src.host, &r.af);
6285	decide_address_family(yyvsp[-1].v.fromto.dst.host, &r.af);
6286
6287	if (yyvsp[0].v.filter_opts.rt) {
6288	if (yyvsp[0].v.filter_opts.rt != PF_DUPTO && !r.direction) {
6289	yyerror("direction must be explicit "
6290	"with rules that specify routing");
6291	YYERRORgoto yyerrlab;
6292	}
6293	r.rt = yyvsp[0].v.filter_opts.rt;
6294	}
6295
6296	if (expand_divertspec(&r, &yyvsp[0].v.filter_opts.divert))
6297	YYERRORgoto yyerrlab;
6298
6299	expand_rule(&r, 0, yyvsp[-4].v.interface, &yyvsp[0].v.filter_opts.nat, &yyvsp[0].v.filter_opts.rdr, &yyvsp[0].v.filter_opts.rroute, yyvsp[-2].v.proto,
6300	yyvsp[-1].v.fromto.src_os,
6301	yyvsp[-1].v.fromto.src.host, yyvsp[-1].v.fromto.src.port, yyvsp[-1].v.fromto.dst.host, yyvsp[-1].v.fromto.dst.port,
6302	yyvsp[0].v.filter_opts.uid, yyvsp[0].v.filter_opts.gid, yyvsp[0].v.filter_opts.rcv, yyvsp[0].v.filter_opts.icmpspec);
6303	}
6304	break;
6305	case 128:
6306	#line 1855 "/usr/src/sbin/pfctl/parse.y"
6307	{
6308	bzero(&filter_opts, sizeof filter_opts);
6309	filter_opts.rtableid = -1;
6310	}
6311	break;
6312	case 129:
6313	#line 1860 "/usr/src/sbin/pfctl/parse.y"
6314	{ yyval.v.filter_opts = filter_opts; }
6315	break;
6316	case 130:
6317	#line 1861 "/usr/src/sbin/pfctl/parse.y"
6318	{
6319	bzero(&filter_opts, sizeof filter_opts);
6320	filter_opts.rtableid = -1;
6321	yyval.v.filter_opts = filter_opts;
6322	}
6323	break;
6324	case 133:
6325	#line 1872 "/usr/src/sbin/pfctl/parse.y"
6326	{
6327	if (filter_opts.uid)
6328	yyvsp[0].v.uid->tail->next = filter_opts.uid;
6329	filter_opts.uid = yyvsp[0].v.uid;
6330	}
6331	break;
6332	case 134:
6333	#line 1877 "/usr/src/sbin/pfctl/parse.y"
6334	{
6335	if (filter_opts.gid)
6336	yyvsp[0].v.gid->tail->next = filter_opts.gid;
6337	filter_opts.gid = yyvsp[0].v.gid;
6338	}
6339	break;
6340	case 135:
6341	#line 1882 "/usr/src/sbin/pfctl/parse.y"
6342	{
6343	if (filter_opts.marker & FOM_FLAGS0x0001) {
6344	yyerror("flags cannot be redefined");
6345	YYERRORgoto yyerrlab;
6346	}
6347	filter_opts.marker \|= FOM_FLAGS0x0001;
6348	filter_opts.flags.b1 \|= yyvsp[0].v.b.b1;
6349	filter_opts.flags.b2 \|= yyvsp[0].v.b.b2;
6350	filter_opts.flags.w \|= yyvsp[0].v.b.w;
6351	filter_opts.flags.w2 \|= yyvsp[0].v.b.w2;
6352	}
6353	break;
6354	case 136:
6355	#line 1893 "/usr/src/sbin/pfctl/parse.y"
6356	{
6357	if (filter_opts.marker & FOM_ICMP0x0002) {
6358	yyerror("icmp-type cannot be redefined");
6359	YYERRORgoto yyerrlab;
6360	}
6361	filter_opts.marker \|= FOM_ICMP0x0002;
6362	filter_opts.icmpspec = yyvsp[0].v.icmp;
6363	}
6364	break;
6365	case 137:
6366	#line 1901 "/usr/src/sbin/pfctl/parse.y"
6367	{
6368	if (filter_opts.marker & FOM_PRIO0x2000) {
6369	yyerror("prio cannot be redefined");
6370	YYERRORgoto yyerrlab;
6371	}
6372	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > IFQ_MAXPRIO8 - 1) {
6373	yyerror("prio must be 0 - %u", IFQ_MAXPRIO8 - 1);
6374	YYERRORgoto yyerrlab;
6375	}
6376	filter_opts.marker \|= FOM_PRIO0x2000;
6377	filter_opts.prio = yyvsp[0].v.number;
6378	}
6379	break;
6380	case 138:
6381	#line 1913 "/usr/src/sbin/pfctl/parse.y"
6382	{
6383	if (filter_opts.marker & FOM_TOS0x0004) {
6384	yyerror("tos cannot be redefined");
6385	YYERRORgoto yyerrlab;
6386	}
6387	filter_opts.marker \|= FOM_TOS0x0004;
6388	filter_opts.tos = yyvsp[0].v.number;
6389	}
6390	break;
6391	case 139:
6392	#line 1921 "/usr/src/sbin/pfctl/parse.y"
6393	{
6394	if (filter_opts.marker & FOM_KEEP0x0008) {
6395	yyerror("modulate or keep cannot be redefined");
6396	YYERRORgoto yyerrlab;
6397	}
6398	filter_opts.marker \|= FOM_KEEP0x0008;
6399	filter_opts.keep.action = yyvsp[0].v.keep_state.action;
6400	filter_opts.keep.options = yyvsp[0].v.keep_state.options;
6401	}
6402	break;
6403	case 140:
6404	#line 1930 "/usr/src/sbin/pfctl/parse.y"
6405	{
6406	filter_opts.fragment = 1;
6407	}
6408	break;
6409	case 141:
6410	#line 1933 "/usr/src/sbin/pfctl/parse.y"
6411	{
6412	filter_opts.allowopts = 1;
6413	}
6414	break;
6415	case 142:
6416	#line 1936 "/usr/src/sbin/pfctl/parse.y"
6417	{
6418	if (filter_opts.label) {
6419	yyerror("label cannot be redefined");
6420	YYERRORgoto yyerrlab;
6421	}
6422	filter_opts.label = yyvsp[0].v.string;
6423	}
6424	break;
6425	case 143:
6426	#line 1943 "/usr/src/sbin/pfctl/parse.y"
6427	{
6428	if (filter_opts.queues.qname) {
6429	yyerror("queue cannot be redefined");
6430	YYERRORgoto yyerrlab;
6431	}
6432	filter_opts.queues = yyvsp[0].v.qassign;
6433	}
6434	break;
6435	case 144:
6436	#line 1950 "/usr/src/sbin/pfctl/parse.y"
6437	{
6438	filter_opts.tag = yyvsp[0].v.string;
6439	}
6440	break;
6441	case 145:
6442	#line 1953 "/usr/src/sbin/pfctl/parse.y"
6443	{
6444	filter_opts.match_tag = yyvsp[0].v.string;
6445	filter_opts.match_tag_not = yyvsp[-2].v.number;
6446	}
6447	break;
6448	case 146:
6449	#line 1957 "/usr/src/sbin/pfctl/parse.y"
6450	{
6451	double p;
6452
6453	p = floor(yyvsp[0].v.probability * UINT_MAX0xffffffffU + 0.5);
6454	if (p < 0.0 \|\| p > UINT_MAX0xffffffffU) {
6455	yyerror("invalid probability: %g%%", yyvsp[0].v.probability * 100);
6456	YYERRORgoto yyerrlab;
6457	}
6458	filter_opts.prob = (u_int32_t)p;
6459	if (filter_opts.prob == 0)
6460	filter_opts.prob = 1;
6461	}
6462	break;
6463	case 147:
6464	#line 1969 "/usr/src/sbin/pfctl/parse.y"
6465	{
6466	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > RT_TABLEID_MAX255) {
6467	yyerror("invalid rtable id");
6468	YYERRORgoto yyerrlab;
6469	} else if (!lookup_rtable(yyvsp[0].v.number)) {
6470	yyerror("rtable %lld does not exist", yyvsp[0].v.number);
6471	YYERRORgoto yyerrlab;
6472	}
6473	filter_opts.rtableid = yyvsp[0].v.number;
6474	}
6475	break;
6476	case 148:
6477	#line 1979 "/usr/src/sbin/pfctl/parse.y"
6478	{
6479	if (filter_opts.divert.type != PF_DIVERT_NONE) {
6480	yyerror("more than one divert option");
6481	YYERRORgoto yyerrlab;
6482	}
6483	filter_opts.divert.type = PF_DIVERT_TO;
6484	if ((filter_opts.divert.addr = host(yyvsp[-2].v.string, pf->opts)) == NULL((void *)0)) {
6485	yyerror("could not parse divert address: %s",
6486	yyvsp[-2].v.string);
6487	free(yyvsp[-2].v.string);
6488	YYERRORgoto yyerrlab;
6489	}
6490	free(yyvsp[-2].v.string);
6491	filter_opts.divert.port = yyvsp[0].v.range.a;
6492	if (!filter_opts.divert.port) {
6493	yyerror("invalid divert port: %u", ntohs(yyvsp[0].v.range.a)(__uint16_t)(__builtin_constant_p(yyvsp[0].v.range.a) ? (__uint16_t )(((__uint16_t)(yyvsp[0].v.range.a) & 0xffU) << 8 \| ((__uint16_t)(yyvsp[0].v.range.a) & 0xff00U) >> 8) : __swap16md(yyvsp[0].v.range.a)));
6494	YYERRORgoto yyerrlab;
6495	}
6496	}
6497	break;
6498	case 149:
6499	#line 1998 "/usr/src/sbin/pfctl/parse.y"
6500	{
6501	if (filter_opts.divert.type != PF_DIVERT_NONE) {
6502	yyerror("more than one divert option");
6503	YYERRORgoto yyerrlab;
6504	}
6505	filter_opts.divert.type = PF_DIVERT_REPLY;
6506	}
6507	break;
6508	case 150:
6509	#line 2005 "/usr/src/sbin/pfctl/parse.y"
6510	{
6511	if (filter_opts.divert.type != PF_DIVERT_NONE) {
6512	yyerror("more than one divert option");
6513	YYERRORgoto yyerrlab;
6514	}
6515	filter_opts.divert.type = PF_DIVERT_PACKET;
6516	/*
6517	* If IP reassembly was not turned off, also
6518	* forcibly enable TCP reassembly by default.
6519	*/
6520	if (pf->reassemble & PF_REASS_ENABLED0x01)
6521	filter_opts.marker \|= FOM_SCRUB_TCP0x0200;
6522
6523	filter_opts.divert.port = yyvsp[0].v.range.a;
6524	if (!filter_opts.divert.port) {
6525	yyerror("invalid divert port: %u", ntohs(yyvsp[0].v.range.a)(__uint16_t)(__builtin_constant_p(yyvsp[0].v.range.a) ? (__uint16_t )(((__uint16_t)(yyvsp[0].v.range.a) & 0xffU) << 8 \| ((__uint16_t)(yyvsp[0].v.range.a) & 0xff00U) >> 8) : __swap16md(yyvsp[0].v.range.a)));
6526	YYERRORgoto yyerrlab;
6527	}
6528	}
6529	break;
6530	case 151:
6531	#line 2024 "/usr/src/sbin/pfctl/parse.y"
6532	{
6533	filter_opts.nodf = yyvsp[-1].v.scrub_opts.nodf;
6534	filter_opts.minttl = yyvsp[-1].v.scrub_opts.minttl;
6535	filter_opts.randomid = yyvsp[-1].v.scrub_opts.randomid;
6536	filter_opts.max_mss = yyvsp[-1].v.scrub_opts.maxmss;
6537	if (yyvsp[-1].v.scrub_opts.reassemble_tcp)
6538	filter_opts.marker \|= FOM_SCRUB_TCP0x0200;
6539	filter_opts.marker \|= yyvsp[-1].v.scrub_opts.marker;
6540	}
6541	break;
6542	case 152:
6543	#line 2033 "/usr/src/sbin/pfctl/parse.y"
6544	{
6545	if (filter_opts.nat.rdr) {
6546	yyerror("cannot respecify nat-to/binat-to");
6547	YYERRORgoto yyerrlab;
6548	}
6549	filter_opts.nat.rdr = yyvsp[-1].v.redirection;
6550	memcpy(&filter_opts.nat.pool_opts, &yyvsp[0].v.pool_opts,
6551	sizeof(filter_opts.nat.pool_opts));
6552	}
6553	break;
6554	case 153:
6555	#line 2042 "/usr/src/sbin/pfctl/parse.y"
6556	{
6557	if (filter_opts.nat.rdr) {
6558	yyerror("cannot respecify af-to");
6559	YYERRORgoto yyerrlab;
6560	}
6561	if (yyvsp[-3].v.i == 0) {
6562	yyerror("no target address family specified");
6563	YYERRORgoto yyerrlab;
6564	}
6565	filter_opts.nat.af = yyvsp[-3].v.i;
6566	filter_opts.nat.rdr = yyvsp[-1].v.redirection;
6567	memcpy(&filter_opts.nat.pool_opts, &yyvsp[0].v.pool_opts,
6568	sizeof(filter_opts.nat.pool_opts));
6569	filter_opts.rdr.rdr =
6570	calloc(1, sizeof(struct redirection));
6571	bzero(&filter_opts.rdr.pool_opts,
6572	sizeof(filter_opts.rdr.pool_opts));
6573	filter_opts.marker \|= FOM_AFTO0x0080;
6574	}
6575	break;
6576	case 154:
6577	#line 2061 "/usr/src/sbin/pfctl/parse.y"
6578	{
6579	if (filter_opts.nat.rdr) {
6580	yyerror("cannot respecify af-to");
6581	YYERRORgoto yyerrlab;
6582	}
6583	if (yyvsp[-6].v.i == 0) {
6584	yyerror("no address family specified");
6585	YYERRORgoto yyerrlab;
6586	}
6587	if ((yyvsp[-4].v.redirection->host->af && yyvsp[-4].v.redirection->host->af != yyvsp[-6].v.i) \|\|
6588	(yyvsp[-1].v.redirection->host->af && yyvsp[-1].v.redirection->host->af != yyvsp[-6].v.i)) {
6589	yyerror("af-to addresses must be in the "
6590	"target address family");
6591	YYERRORgoto yyerrlab;
6592	}
6593	filter_opts.nat.af = yyvsp[-6].v.i;
6594	filter_opts.nat.rdr = yyvsp[-4].v.redirection;
6595	memcpy(&filter_opts.nat.pool_opts, &yyvsp[-3].v.pool_opts,
6596	sizeof(filter_opts.nat.pool_opts));
6597	filter_opts.rdr.af = yyvsp[-6].v.i;
6598	filter_opts.rdr.rdr = yyvsp[-1].v.redirection;
6599	memcpy(&filter_opts.nat.pool_opts, &yyvsp[0].v.pool_opts,
6600	sizeof(filter_opts.nat.pool_opts));
6601	filter_opts.marker \|= FOM_AFTO0x0080;
6602	}
6603	break;
6604	case 155:
6605	#line 2086 "/usr/src/sbin/pfctl/parse.y"
6606	{
6607	if (filter_opts.rdr.rdr) {
6608	yyerror("cannot respecify rdr-to");
6609	YYERRORgoto yyerrlab;
6610	}
6611	filter_opts.rdr.rdr = yyvsp[-1].v.redirection;
6612	memcpy(&filter_opts.rdr.pool_opts, &yyvsp[0].v.pool_opts,
6613	sizeof(filter_opts.rdr.pool_opts));
6614	}
6615	break;
6616	case 156:
6617	#line 2095 "/usr/src/sbin/pfctl/parse.y"
6618	{
6619	if (filter_opts.nat.rdr) {
6620	yyerror("cannot respecify nat-to/binat-to");
6621	YYERRORgoto yyerrlab;
6622	}
6623	filter_opts.nat.rdr = yyvsp[-1].v.redirection;
6624	filter_opts.nat.binat = 1;
6625	memcpy(&filter_opts.nat.pool_opts, &yyvsp[0].v.pool_opts,
6626	sizeof(filter_opts.nat.pool_opts));
6627	filter_opts.nat.pool_opts.staticport = 1;
6628	}
6629	break;
6630	case 157:
6631	#line 2106 "/usr/src/sbin/pfctl/parse.y"
6632	{
6633	filter_opts.rt = PF_ROUTETO;
6634	}
6635	break;
6636	case 158:
6637	#line 2109 "/usr/src/sbin/pfctl/parse.y"
6638	{
6639	filter_opts.rt = PF_REPLYTO;
6640	}
6641	break;
6642	case 159:
6643	#line 2112 "/usr/src/sbin/pfctl/parse.y"
6644	{
6645	filter_opts.rt = PF_DUPTO;
6646	}
6647	break;
6648	case 160:
6649	#line 2115 "/usr/src/sbin/pfctl/parse.y"
6650	{
6651	if (filter_opts.rcv) {
6652	yyerror("cannot respecify received-on");
6653	YYERRORgoto yyerrlab;
6654	}
6655	filter_opts.rcv = yyvsp[0].v.interface;
6656	filter_opts.rcv->not = yyvsp[-2].v.number;
6657	}
6658	break;
6659	case 161:
6660	#line 2123 "/usr/src/sbin/pfctl/parse.y"
6661	{
6662	filter_opts.marker \|= FOM_ONCE0x1000;
6663	}
6664	break;
6665	case 162:
6666	#line 2126 "/usr/src/sbin/pfctl/parse.y"
6667	{
6668	if (yyvsp[-2].v.number < 0 \|\| yyvsp[-2].v.number > UINT_MAX0xffffffffU \|\|
6669	yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > UINT_MAX0xffffffffU) {
6670	yyerror("only positive values permitted");
6671	YYERRORgoto yyerrlab;
6672	}
6673	if (filter_opts.pktrate.limit) {
6674	yyerror("cannot respecify max-pkt-rate");
6675	YYERRORgoto yyerrlab;
6676	}
6677	filter_opts.pktrate.limit = yyvsp[-2].v.number;
6678	filter_opts.pktrate.seconds = yyvsp[0].v.number;
6679	}
6680	break;
6681	case 164:
6682	#line 2142 "/usr/src/sbin/pfctl/parse.y"
6683	{ yyval.v.filter_opts = filter_opts; }
6684	break;
6685	case 165:
6686	#line 2143 "/usr/src/sbin/pfctl/parse.y"
6687	{ yyval.v.filter_opts = filter_opts; }
6688	break;
6689	case 168:
6690	#line 2150 "/usr/src/sbin/pfctl/parse.y"
6691	{
6692	if (filter_opts.marker & FOM_SETPRIO0x0400) {
6693	yyerror("prio cannot be redefined");
6694	YYERRORgoto yyerrlab;
6695	}
6696	filter_opts.marker \|= FOM_SETPRIO0x0400;
6697	filter_opts.set_prio[0] = yyvsp[0].v.b.b1;
6698	filter_opts.set_prio[1] = yyvsp[0].v.b.b2;
6699	}
6700	break;
6701	case 169:
6702	#line 2159 "/usr/src/sbin/pfctl/parse.y"
6703	{
6704	if (filter_opts.queues.qname) {
6705	yyerror("queue cannot be redefined");
6706	YYERRORgoto yyerrlab;
6707	}
6708	filter_opts.queues = yyvsp[0].v.qassign;
6709	}
6710	break;
6711	case 170:
6712	#line 2166 "/usr/src/sbin/pfctl/parse.y"
6713	{
6714	if (filter_opts.marker & FOM_SETTOS0x0100) {
6715	yyerror("tos cannot be respecified");
6716	YYERRORgoto yyerrlab;
6717	}
6718	filter_opts.marker \|= FOM_SETTOS0x0100;
6719	filter_opts.settos = yyvsp[0].v.number;
6720	}
6721	break;
6722	case 171:
6723	#line 2174 "/usr/src/sbin/pfctl/parse.y"
6724	{
6725	if (filter_opts.delay) {
6726	yyerror("delay cannot be respecified");
6727	YYERRORgoto yyerrlab;
6728	}
6729	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > 0xffff) {
6730	yyerror("illegal delay value %lld (0-%u)", yyvsp[0].v.number,
6731	0xffff);
6732	YYERRORgoto yyerrlab;
6733	}
6734	filter_opts.marker \|= FOM_SETDELAY0x4000;
6735	filter_opts.delay = yyvsp[0].v.number;
6736	}
6737	break;
6738	case 172:
6739	#line 2189 "/usr/src/sbin/pfctl/parse.y"
6740	{
6741	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > IFQ_MAXPRIO8 - 1) {
6742	yyerror("prio must be 0 - %u", IFQ_MAXPRIO8 - 1);
6743	YYERRORgoto yyerrlab;
6744	}
6745	yyval.v.b.b1 = yyval.v.b.b2 = yyvsp[0].v.number;
6746	}
6747	break;
6748	case 173:
6749	#line 2196 "/usr/src/sbin/pfctl/parse.y"
6750	{
6751	if (yyvsp[-3].v.number < 0 \|\| yyvsp[-3].v.number > IFQ_MAXPRIO8 - 1 \|\|
6752	yyvsp[-1].v.number < 0 \|\| yyvsp[-1].v.number > IFQ_MAXPRIO8 - 1) {
6753	yyerror("prio must be 0 - %u", IFQ_MAXPRIO8 - 1);
6754	YYERRORgoto yyerrlab;
6755	}
6756	yyval.v.b.b1 = yyvsp[-3].v.number;
6757	yyval.v.b.b2 = yyvsp[-1].v.number;
6758	}
6759	break;
6760	case 174:
6761	#line 2207 "/usr/src/sbin/pfctl/parse.y"
6762	{
6763	char *e;
6764	double p = strtod(yyvsp[0].v.string, &e);
6765
6766	if (*e == '%') {
6767	p *= 0.01;
6768	e++;
6769	}
6770	if (*e) {
6771	yyerror("invalid probability: %s", yyvsp[0].v.string);
6772	free(yyvsp[0].v.string);
6773	YYERRORgoto yyerrlab;
6774	}
6775	free(yyvsp[0].v.string);
6776	yyval.v.probability = p;
6777	}
6778	break;
6779	case 175:
6780	#line 2223 "/usr/src/sbin/pfctl/parse.y"
6781	{
6782	yyval.v.probability = (double)yyvsp[0].v.number;
6783	}
6784	break;
6785	case 176:
6786	#line 2229 "/usr/src/sbin/pfctl/parse.y"
6787	{ yyval.v.b.b1 = PF_PASS; yyval.v.b.b2 = yyval.v.b.w = 0; }
6788	break;
6789	case 177:
6790	#line 2230 "/usr/src/sbin/pfctl/parse.y"
6791	{ yyval.v.b.b1 = PF_MATCH; yyval.v.b.b2 = yyval.v.b.w = 0; }
6792	break;
6793	case 178:
6794	#line 2231 "/usr/src/sbin/pfctl/parse.y"
6795	{ yyval.v.b = yyvsp[0].v.b; yyval.v.b.b1 = PF_DROP; }
6796	break;
6797	case 179:
6798	#line 2234 "/usr/src/sbin/pfctl/parse.y"
6799	{
6800	yyval.v.b.b2 = blockpolicy;
6801	yyval.v.b.w = returnicmpdefault;
6802	yyval.v.b.w2 = returnicmp6default;
6803	}
6804	break;
6805	case 180:
6806	#line 2239 "/usr/src/sbin/pfctl/parse.y"
6807	{
6808	yyval.v.b.b2 = PFRULE_DROP0x0000;
6809	yyval.v.b.w = 0;
6810	yyval.v.b.w2 = 0;
6811	}
6812	break;
6813	case 181:
6814	#line 2244 "/usr/src/sbin/pfctl/parse.y"
6815	{
6816	yyval.v.b.b2 = PFRULE_RETURNRST0x0001;
6817	yyval.v.b.w = 0;
6818	yyval.v.b.w2 = 0;
6819	}
6820	break;
6821	case 182:
6822	#line 2249 "/usr/src/sbin/pfctl/parse.y"
6823	{
6824	if (yyvsp[-1].v.number < 0 \|\| yyvsp[-1].v.number > 255) {
6825	yyerror("illegal ttl value %lld", yyvsp[-1].v.number);
6826	YYERRORgoto yyerrlab;
6827	}
6828	yyval.v.b.b2 = PFRULE_RETURNRST0x0001;
6829	yyval.v.b.w = yyvsp[-1].v.number;
6830	yyval.v.b.w2 = 0;
6831	}
6832	break;
6833	case 183:
6834	#line 2258 "/usr/src/sbin/pfctl/parse.y"
6835	{
6836	yyval.v.b.b2 = PFRULE_RETURNICMP0x0004;
6837	yyval.v.b.w = returnicmpdefault;
6838	yyval.v.b.w2 = returnicmp6default;
6839	}
6840	break;
6841	case 184:
6842	#line 2263 "/usr/src/sbin/pfctl/parse.y"
6843	{
6844	yyval.v.b.b2 = PFRULE_RETURNICMP0x0004;
6845	yyval.v.b.w = returnicmpdefault;
6846	yyval.v.b.w2 = returnicmp6default;
6847	}
6848	break;
6849	case 185:
6850	#line 2268 "/usr/src/sbin/pfctl/parse.y"
6851	{
6852	yyval.v.b.b2 = PFRULE_RETURNICMP0x0004;
6853	yyval.v.b.w = yyvsp[-1].v.number;
6854	yyval.v.b.w2 = returnicmpdefault;
6855	}
6856	break;
6857	case 186:
6858	#line 2273 "/usr/src/sbin/pfctl/parse.y"
6859	{
6860	yyval.v.b.b2 = PFRULE_RETURNICMP0x0004;
6861	yyval.v.b.w = returnicmpdefault;
6862	yyval.v.b.w2 = yyvsp[-1].v.number;
6863	}
6864	break;
6865	case 187:
6866	#line 2278 "/usr/src/sbin/pfctl/parse.y"
6867	{
6868	yyval.v.b.b2 = PFRULE_RETURNICMP0x0004;
6869	yyval.v.b.w = yyvsp[-3].v.number;
6870	yyval.v.b.w2 = yyvsp[-1].v.number;
6871	}
6872	break;
6873	case 188:
6874	#line 2283 "/usr/src/sbin/pfctl/parse.y"
6875	{
6876	yyval.v.b.b2 = PFRULE_RETURN0x0008;
6877	yyval.v.b.w = returnicmpdefault;
6878	yyval.v.b.w2 = returnicmp6default;
6879	}
6880	break;
6881	case 189:
6882	#line 2290 "/usr/src/sbin/pfctl/parse.y"
6883	{
6884	if (!(yyval.v.number = parseicmpspec(yyvsp[0].v.string, AF_INET2))) {
6885	free(yyvsp[0].v.string);
6886	YYERRORgoto yyerrlab;
6887	}
6888	free(yyvsp[0].v.string);
6889	}
6890	break;
6891	case 190:
6892	#line 2297 "/usr/src/sbin/pfctl/parse.y"
6893	{
6894	u_int8_t icmptype;
6895
6896	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > 255) {
6897	yyerror("invalid icmp code %lld", yyvsp[0].v.number);
6898	YYERRORgoto yyerrlab;
6899	}
6900	icmptype = returnicmpdefault >> 8;
6901	yyval.v.number = (icmptype << 8 \| yyvsp[0].v.number);
6902	}
6903	break;
6904	case 191:
6905	#line 2309 "/usr/src/sbin/pfctl/parse.y"
6906	{
6907	if (!(yyval.v.number = parseicmpspec(yyvsp[0].v.string, AF_INET624))) {
6908	free(yyvsp[0].v.string);
6909	YYERRORgoto yyerrlab;
6910	}
6911	free(yyvsp[0].v.string);
6912	}
6913	break;
6914	case 192:
6915	#line 2316 "/usr/src/sbin/pfctl/parse.y"
6916	{
6917	u_int8_t icmptype;
6918
6919	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > 255) {
6920	yyerror("invalid icmp code %lld", yyvsp[0].v.number);
6921	YYERRORgoto yyerrlab;
6922	}
6923	icmptype = returnicmp6default >> 8;
6924	yyval.v.number = (icmptype << 8 \| yyvsp[0].v.number);
6925	}
6926	break;
6927	case 193:
6928	#line 2328 "/usr/src/sbin/pfctl/parse.y"
6929	{ yyval.v.i = PF_INOUT; }
6930	break;
6931	case 194:
6932	#line 2329 "/usr/src/sbin/pfctl/parse.y"
6933	{ yyval.v.i = PF_IN; }
6934	break;
6935	case 195:
6936	#line 2330 "/usr/src/sbin/pfctl/parse.y"
6937	{ yyval.v.i = PF_OUT; }
6938	break;
6939	case 196:
6940	#line 2333 "/usr/src/sbin/pfctl/parse.y"
6941	{ yyval.v.logquick.quick = 0; }
6942	break;
6943	case 197:
6944	#line 2334 "/usr/src/sbin/pfctl/parse.y"
6945	{ yyval.v.logquick.quick = 1; }
6946	break;
6947	case 198:
6948	#line 2337 "/usr/src/sbin/pfctl/parse.y"
6949	{ yyval.v.logquick.log = 0; yyval.v.logquick.quick = 0; yyval.v.logquick.logif = 0; }
6950	break;
6951	case 199:
6952	#line 2338 "/usr/src/sbin/pfctl/parse.y"
6953	{ yyval.v.logquick = yyvsp[0].v.logquick; yyval.v.logquick.quick = 0; }
6954	break;
6955	case 200:
6956	#line 2339 "/usr/src/sbin/pfctl/parse.y"
6957	{ yyval.v.logquick.quick = 1; yyval.v.logquick.log = 0; yyval.v.logquick.logif = 0; }
6958	break;
6959	case 201:
6960	#line 2340 "/usr/src/sbin/pfctl/parse.y"
6961	{ yyval.v.logquick = yyvsp[-1].v.logquick; yyval.v.logquick.quick = 1; }
6962	break;
6963	case 202:
6964	#line 2341 "/usr/src/sbin/pfctl/parse.y"
6965	{ yyval.v.logquick = yyvsp[0].v.logquick; yyval.v.logquick.quick = 1; }
6966	break;
6967	case 203:
6968	#line 2344 "/usr/src/sbin/pfctl/parse.y"
6969	{ yyval.v.logquick.log = PF_LOG0x01; yyval.v.logquick.logif = 0; }
6970	break;
6971	case 204:
6972	#line 2345 "/usr/src/sbin/pfctl/parse.y"
6973	{
6974	yyval.v.logquick.log = PF_LOG0x01 \| yyvsp[-1].v.logquick.log;
6975	yyval.v.logquick.logif = yyvsp[-1].v.logquick.logif;
6976	}
6977	break;
6978	case 205:
6979	#line 2351 "/usr/src/sbin/pfctl/parse.y"
6980	{ yyval.v.logquick = yyvsp[0].v.logquick; }
6981	break;
6982	case 206:
6983	#line 2352 "/usr/src/sbin/pfctl/parse.y"
6984	{
6985	yyval.v.logquick.log = yyvsp[-2].v.logquick.log \| yyvsp[0].v.logquick.log;
6986	yyval.v.logquick.logif = yyvsp[0].v.logquick.logif;
6987	if (yyval.v.logquick.logif == 0)
6988	yyval.v.logquick.logif = yyvsp[-2].v.logquick.logif;
6989	}
6990	break;
6991	case 207:
6992	#line 2360 "/usr/src/sbin/pfctl/parse.y"
6993	{ yyval.v.logquick.log = PF_LOG_ALL0x02; yyval.v.logquick.logif = 0; }
6994	break;
6995	case 208:
6996	#line 2361 "/usr/src/sbin/pfctl/parse.y"
6997	{ yyval.v.logquick.log = PF_LOG_MATCHES0x10; yyval.v.logquick.logif = 0; }
6998	break;
6999	case 209:
7000	#line 2362 "/usr/src/sbin/pfctl/parse.y"
7001	{ yyval.v.logquick.log = PF_LOG_USER0x04; yyval.v.logquick.logif = 0; }
7002	break;
7003	case 210:
7004	#line 2363 "/usr/src/sbin/pfctl/parse.y"
7005	{
7006	const char *errstr;
7007	u_int i;
7008
7009	yyval.v.logquick.log = 0;
7010	if (strncmp(yyvsp[0].v.string, "pflog", 5)) {
7011	yyerror("%s: should be a pflog interface", yyvsp[0].v.string);
7012	free(yyvsp[0].v.string);
7013	YYERRORgoto yyerrlab;
7014	}
7015	i = strtonum(yyvsp[0].v.string + 5, 0, 255, &errstr);
7016	if (errstr) {
7017	yyerror("%s: %s", yyvsp[0].v.string, errstr);
7018	free(yyvsp[0].v.string);
7019	YYERRORgoto yyerrlab;
7020	}
7021	free(yyvsp[0].v.string);
7022	yyval.v.logquick.logif = i;
7023	}
7024	break;
7025	case 211:
7026	#line 2384 "/usr/src/sbin/pfctl/parse.y"
7027	{ yyval.v.interface = NULL((void *)0); }
7028	break;
7029	case 212:
7030	#line 2385 "/usr/src/sbin/pfctl/parse.y"
7031	{ yyval.v.interface = yyvsp[0].v.interface; }
7032	break;
7033	case 213:
7034	#line 2386 "/usr/src/sbin/pfctl/parse.y"
7035	{ yyval.v.interface = yyvsp[-1].v.interface; }
7036	break;
7037	case 214:
7038	#line 2389 "/usr/src/sbin/pfctl/parse.y"
7039	{ yyval.v.interface = yyvsp[-1].v.interface; }
7040	break;
7041	case 215:
7042	#line 2390 "/usr/src/sbin/pfctl/parse.y"
7043	{
7044	yyvsp[-3].v.interface->tail->next = yyvsp[-1].v.interface;
7045	yyvsp[-3].v.interface->tail = yyvsp[-1].v.interface;
7046	yyval.v.interface = yyvsp[-3].v.interface;
7047	}
7048	break;
7049	case 216:
7050	#line 2397 "/usr/src/sbin/pfctl/parse.y"
7051	{ yyval.v.interface = yyvsp[0].v.interface; yyval.v.interface->not = yyvsp[-1].v.number; }
7052	break;
7053	case 217:
7054	#line 2400 "/usr/src/sbin/pfctl/parse.y"
7055	{
7056	struct node_host *n;
7057
7058	yyval.v.interface = calloc(1, sizeof(struct node_if));
7059	if (yyval.v.interface == NULL((void *)0))
7060	err(1, "if_item: calloc");
7061	if (strlcpy(yyval.v.interface->ifname, yyvsp[0].v.string, sizeof(yyval.v.interface->ifname)) >=
7062	sizeof(yyval.v.interface->ifname)) {
7063	free(yyvsp[0].v.string);
7064	free(yyval.v.interface);
7065	yyerror("interface name too long");
7066	YYERRORgoto yyerrlab;
7067	}
7068
7069	if ((n = ifa_exists(yyvsp[0].v.string)) != NULL((void *)0))
7070	yyval.v.interface->ifa_flags = n->ifa_flags;
7071
7072	free(yyvsp[0].v.string);
7073	yyval.v.interface->not = 0;
7074	yyval.v.interface->next = NULL((void *)0);
7075	yyval.v.interface->tail = yyval.v.interface;
7076	}
7077	break;
7078	case 218:
7079	#line 2422 "/usr/src/sbin/pfctl/parse.y"
7080	{
7081	yyval.v.interface = calloc(1, sizeof(struct node_if));
7082	if (yyval.v.interface == NULL((void *)0))
7083	err(1, "if_item: calloc");
7084	strlcpy(yyval.v.interface->ifname, "any", sizeof(yyval.v.interface->ifname));
7085	yyval.v.interface->not = 0;
7086	yyval.v.interface->next = NULL((void *)0);
7087	yyval.v.interface->tail = yyval.v.interface;
7088	}
7089	break;
7090	case 219:
7091	#line 2431 "/usr/src/sbin/pfctl/parse.y"
7092	{
7093	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > RT_TABLEID_MAX255)
7094	yyerror("rdomain %lld outside range", yyvsp[0].v.number);
7095
7096	yyval.v.interface = calloc(1, sizeof(struct node_if));
7097	if (yyval.v.interface == NULL((void *)0))
7098	err(1, "if_item: calloc");
7099	yyval.v.interface->not = 0;
7100	yyval.v.interface->use_rdomain = 1;
7101	yyval.v.interface->rdomain = yyvsp[0].v.number;
7102	yyval.v.interface->next = NULL((void *)0);
7103	yyval.v.interface->tail = yyval.v.interface;
7104	}
7105	break;
7106	case 220:
7107	#line 2446 "/usr/src/sbin/pfctl/parse.y"
7108	{ yyval.v.i = 0; }
7109	break;
7110	case 221:
7111	#line 2447 "/usr/src/sbin/pfctl/parse.y"
7112	{ yyval.v.i = AF_INET2; }
7113	break;
7114	case 222:
7115	#line 2448 "/usr/src/sbin/pfctl/parse.y"
7116	{ yyval.v.i = AF_INET624; }
7117	break;
7118	case 223:
7119	#line 2451 "/usr/src/sbin/pfctl/parse.y"
7120	{ yyval.v.proto = NULL((void *)0); }
7121	break;
7122	case 224:
7123	#line 2452 "/usr/src/sbin/pfctl/parse.y"
7124	{ yyval.v.proto = yyvsp[0].v.proto; }
7125	break;
7126	case 225:
7127	#line 2453 "/usr/src/sbin/pfctl/parse.y"
7128	{ yyval.v.proto = yyvsp[-1].v.proto; }
7129	break;
7130	case 226:
7131	#line 2456 "/usr/src/sbin/pfctl/parse.y"
7132	{ yyval.v.proto = yyvsp[-1].v.proto; }
7133	break;
7134	case 227:
7135	#line 2457 "/usr/src/sbin/pfctl/parse.y"
7136	{
7137	yyvsp[-3].v.proto->tail->next = yyvsp[-1].v.proto;
7138	yyvsp[-3].v.proto->tail = yyvsp[-1].v.proto;
7139	yyval.v.proto = yyvsp[-3].v.proto;
7140	}
7141	break;
7142	case 228:
7143	#line 2464 "/usr/src/sbin/pfctl/parse.y"
7144	{
7145	u_int8_t pr;
7146
7147	pr = (u_int8_t)yyvsp[0].v.number;
7148	if (pr == 0) {
7149	yyerror("proto 0 cannot be used");
7150	YYERRORgoto yyerrlab;
7151	}
7152	yyval.v.proto = calloc(1, sizeof(struct node_proto));
7153	if (yyval.v.proto == NULL((void *)0))
7154	err(1, "proto_item: calloc");
7155	yyval.v.proto->proto = pr;
7156	yyval.v.proto->next = NULL((void *)0);
7157	yyval.v.proto->tail = yyval.v.proto;
7158	}
7159	break;
7160	case 229:
7161	#line 2481 "/usr/src/sbin/pfctl/parse.y"
7162	{
7163	struct protoent *p;
7164
7165	p = getprotobyname(yyvsp[0].v.string);
7166	if (p == NULL((void *)0)) {
7167	yyerror("unknown protocol %s", yyvsp[0].v.string);
7168	free(yyvsp[0].v.string);
7169	YYERRORgoto yyerrlab;
7170	}
7171	yyval.v.number = p->p_proto;
7172	free(yyvsp[0].v.string);
7173	}
7174	break;
7175	case 230:
7176	#line 2493 "/usr/src/sbin/pfctl/parse.y"
7177	{
7178	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > 255) {
7179	yyerror("protocol outside range");
7180	YYERRORgoto yyerrlab;
7181	}
7182	}
7183	break;
7184	case 231:
7185	#line 2501 "/usr/src/sbin/pfctl/parse.y"
7186	{
7187	yyval.v.fromto.src.host = NULL((void *)0);
7188	yyval.v.fromto.src.port = NULL((void *)0);
7189	yyval.v.fromto.dst.host = NULL((void *)0);
7190	yyval.v.fromto.dst.port = NULL((void *)0);
7191	yyval.v.fromto.src_os = NULL((void *)0);
7192	}
7193	break;
7194	case 232:
7195	#line 2508 "/usr/src/sbin/pfctl/parse.y"
7196	{
7197	yyval.v.fromto.src = yyvsp[-2].v.peer;
7198	yyval.v.fromto.src_os = yyvsp[-1].v.os;
7199	yyval.v.fromto.dst = yyvsp[0].v.peer;
7200	}
7201	break;
7202	case 233:
7203	#line 2515 "/usr/src/sbin/pfctl/parse.y"
7204	{ yyval.v.os = NULL((void *)0); }
7205	break;
7206	case 234:
7207	#line 2516 "/usr/src/sbin/pfctl/parse.y"
7208	{ yyval.v.os = yyvsp[0].v.os; }
7209	break;
7210	case 235:
7211	#line 2517 "/usr/src/sbin/pfctl/parse.y"
7212	{ yyval.v.os = yyvsp[-1].v.os; }
7213	break;
7214	case 236:
7215	#line 2520 "/usr/src/sbin/pfctl/parse.y"
7216	{
7217	yyval.v.os = calloc(1, sizeof(struct node_os));
7218	if (yyval.v.os == NULL((void *)0))
7219	err(1, "os: calloc");
7220	yyval.v.os->os = yyvsp[0].v.string;
7221	yyval.v.os->tail = yyval.v.os;
7222	}
7223	break;
7224	case 237:
7225	#line 2529 "/usr/src/sbin/pfctl/parse.y"
7226	{ yyval.v.os = yyvsp[-1].v.os; }
7227	break;
7228	case 238:
7229	#line 2530 "/usr/src/sbin/pfctl/parse.y"
7230	{
7231	yyvsp[-3].v.os->tail->next = yyvsp[-1].v.os;
7232	yyvsp[-3].v.os->tail = yyvsp[-1].v.os;
7233	yyval.v.os = yyvsp[-3].v.os;
7234	}
7235	break;
7236	case 239:
7237	#line 2537 "/usr/src/sbin/pfctl/parse.y"
7238	{
7239	yyval.v.peer.host = NULL((void *)0);
7240	yyval.v.peer.port = NULL((void *)0);
7241	}
7242	break;
7243	case 240:
7244	#line 2541 "/usr/src/sbin/pfctl/parse.y"
7245	{
7246	yyval.v.peer = yyvsp[0].v.peer;
7247	}
7248	break;
7249	case 241:
7250	#line 2546 "/usr/src/sbin/pfctl/parse.y"
7251	{
7252	yyval.v.peer.host = NULL((void *)0);
7253	yyval.v.peer.port = NULL((void *)0);
7254	}
7255	break;
7256	case 242:
7257	#line 2550 "/usr/src/sbin/pfctl/parse.y"
7258	{
7259	if (disallow_urpf_failed(yyvsp[0].v.peer.host, "\"urpf-failed\" is "
7260	"not permitted in a destination address"))
7261	YYERRORgoto yyerrlab;
7262	yyval.v.peer = yyvsp[0].v.peer;
7263	}
7264	break;
7265	case 243:
7266	#line 2558 "/usr/src/sbin/pfctl/parse.y"
7267	{
7268	yyval.v.peer.host = yyvsp[0].v.host;
7269	yyval.v.peer.port = NULL((void *)0);
7270	}
7271	break;
7272	case 244:
7273	#line 2562 "/usr/src/sbin/pfctl/parse.y"
7274	{
7275	yyval.v.peer.host = yyvsp[-2].v.host;
7276	yyval.v.peer.port = yyvsp[0].v.port;
7277	}
7278	break;
7279	case 245:
7280	#line 2566 "/usr/src/sbin/pfctl/parse.y"
7281	{
7282	yyval.v.peer.host = NULL((void *)0);
7283	yyval.v.peer.port = yyvsp[0].v.port;
7284	}
7285	break;
7286	case 248:
7287	#line 2576 "/usr/src/sbin/pfctl/parse.y"
7288	{ yyval.v.host = NULL((void *)0); }
7289	break;
7290	case 249:
7291	#line 2577 "/usr/src/sbin/pfctl/parse.y"
7292	{ yyval.v.host = yyvsp[0].v.host; }
7293	break;
7294	case 250:
7295	#line 2578 "/usr/src/sbin/pfctl/parse.y"
7296	{ yyval.v.host = yyvsp[-1].v.host; }
7297	break;
7298	case 251:
7299	#line 2582 "/usr/src/sbin/pfctl/parse.y"
7300	{ yyval.v.host = yyvsp[-1].v.host; }
7301	break;
7302	case 252:
7303	#line 2583 "/usr/src/sbin/pfctl/parse.y"
7304	{
7305	if (yyvsp[-3].v.host == NULL((void *)0)) {
7306	freehostlist(yyvsp[-1].v.host);
7307	yyval.v.host = yyvsp[-3].v.host;
7308	} else if (yyvsp[-1].v.host == NULL((void *)0)) {
7309	freehostlist(yyvsp[-3].v.host);
7310	yyval.v.host = yyvsp[-1].v.host;
7311	} else {
7312	yyvsp[-3].v.host->tail->next = yyvsp[-1].v.host;
7313	yyvsp[-3].v.host->tail = yyvsp[-1].v.host->tail;
7314	yyval.v.host = yyvsp[-3].v.host;
7315	}
7316	}
7317	break;
7318	case 253:
7319	#line 2598 "/usr/src/sbin/pfctl/parse.y"
7320	{
7321	struct node_host *n;
7322
7323	for (n = yyvsp[0].v.host; n != NULL((void *)0); n = n->next)
7324	n->not = yyvsp[-1].v.number;
7325	yyval.v.host = yyvsp[0].v.host;
7326	}
7327	break;
7328	case 254:
7329	#line 2605 "/usr/src/sbin/pfctl/parse.y"
7330	{
7331	yyval.v.host = calloc(1, sizeof(struct node_host));
7332	if (yyval.v.host == NULL((void *)0))
7333	err(1, "xhost: calloc");
7334	yyval.v.host->addr.type = PF_ADDR_NOROUTE;
7335	yyval.v.host->next = NULL((void *)0);
7336	yyval.v.host->not = yyvsp[-1].v.number;
7337	yyval.v.host->tail = yyval.v.host;
7338	}
7339	break;
7340	case 255:
7341	#line 2614 "/usr/src/sbin/pfctl/parse.y"
7342	{
7343	yyval.v.host = calloc(1, sizeof(struct node_host));
7344	if (yyval.v.host == NULL((void *)0))
7345	err(1, "xhost: calloc");
7346	yyval.v.host->addr.type = PF_ADDR_URPFFAILED;
7347	yyval.v.host->next = NULL((void *)0);
7348	yyval.v.host->not = yyvsp[-1].v.number;
7349	yyval.v.host->tail = yyval.v.host;
7350	}
7351	break;
7352	case 256:
7353	#line 2625 "/usr/src/sbin/pfctl/parse.y"
7354	{
7355	if (yyvsp[0].v.number < 1 \|\| yyvsp[0].v.number > USHRT_MAX0xffff) {
7356	yyerror("weight out of range");
7357	YYERRORgoto yyerrlab;
7358	}
7359	yyval.v.weight = yyvsp[0].v.number;
7360	}
7361	break;
7362	case 257:
7363	#line 2632 "/usr/src/sbin/pfctl/parse.y"
7364	{ yyval.v.weight = 0; }
7365	break;
7366	case 258:
7367	#line 2635 "/usr/src/sbin/pfctl/parse.y"
7368	{
7369	if ((yyval.v.host = host(yyvsp[0].v.string, pf->opts)) == NULL((void *)0)) {
7370	/* error. "any" is handled elsewhere */
7371	free(yyvsp[0].v.string);
7372	yyerror("could not parse host specification");
7373	YYERRORgoto yyerrlab;
7374	}
7375	free(yyvsp[0].v.string);
7376
7377	}
7378	break;
7379	case 259:
7380	#line 2645 "/usr/src/sbin/pfctl/parse.y"
7381	{
7382	struct node_host b, e;
7383
7384	if ((b = host(yyvsp[-2].v.string, pf->opts)) == NULL((void *)0) \|\|
7385	(e = host(yyvsp[0].v.string, pf->opts)) == NULL((void *)0)) {
7386	free(yyvsp[-2].v.string);
7387	free(yyvsp[0].v.string);
7388	yyerror("could not parse host specification");
7389	YYERRORgoto yyerrlab;
7390	}
7391	if (b->af != e->af \|\|
7392	b->addr.type != PF_ADDR_ADDRMASK \|\|
7393	e->addr.type != PF_ADDR_ADDRMASK \|\|
7394	unmask(&b->addr.v.a.mask) !=
7395	(b->af == AF_INET2 ? 32 : 128) \|\|
7396	unmask(&e->addr.v.a.mask) !=
7397	(e->af == AF_INET2 ? 32 : 128) \|\|
7398	b->next != NULL((void *)0) \|\| b->not \|\|
7399	e->next != NULL((void *)0) \|\| e->not) {
7400	free(b);
7401	free(e);
7402	free(yyvsp[-2].v.string);
7403	free(yyvsp[0].v.string);
7404	yyerror("invalid address range");
7405	YYERRORgoto yyerrlab;
7406	}
7407	memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr,
7408	sizeof(b->addr.v.a.mask));
7409	b->addr.type = PF_ADDR_RANGE;
7410	yyval.v.host = b;
7411	free(e);
7412	free(yyvsp[-2].v.string);
7413	free(yyvsp[0].v.string);
7414	}
7415	break;
7416	case 260:
7417	#line 2679 "/usr/src/sbin/pfctl/parse.y"
7418	{
7419	char *buf;
7420
7421	if (asprintf(&buf, "%s/%lld", yyvsp[-2].v.string, yyvsp[0].v.number) == -1)
7422	err(1, "host: asprintf");
7423	free(yyvsp[-2].v.string);
7424	if ((yyval.v.host = host(buf, pf->opts)) == NULL((void *)0)) {
7425	/* error. "any" is handled elsewhere */
7426	free(buf);
7427	yyerror("could not parse host specification");
7428	YYERRORgoto yyerrlab;
7429	}
7430	free(buf);
7431	}
7432	break;
7433	case 261:
7434	#line 2693 "/usr/src/sbin/pfctl/parse.y"
7435	{
7436	char *buf;
7437
7438	/* ie. for 10/8 parsing */
7439	if (asprintf(&buf, "%lld/%lld", yyvsp[-2].v.number, yyvsp[0].v.number) == -1)
7440	err(1, "host: asprintf");
7441	if ((yyval.v.host = host(buf, pf->opts)) == NULL((void *)0)) {
7442	/* error. "any" is handled elsewhere */
7443	free(buf);
7444	yyerror("could not parse host specification");
7445	YYERRORgoto yyerrlab;
7446	}
7447	free(buf);
7448	}
7449	break;
7450	case 263:
7451	#line 2708 "/usr/src/sbin/pfctl/parse.y"
7452	{
7453	struct node_host *n;
7454
7455	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > 128) {
7456	yyerror("bit number too big");
7457	YYERRORgoto yyerrlab;
7458	}
7459	yyval.v.host = yyvsp[-2].v.host;
7460	for (n = yyvsp[-2].v.host; n != NULL((void *)0); n = n->next)
7461	set_ipmask(n, yyvsp[0].v.number);
7462	}
7463	break;
7464	case 264:
7465	#line 2719 "/usr/src/sbin/pfctl/parse.y"
7466	{
7467	if (strlen(yyvsp[-1].v.string) >= PF_TABLE_NAME_SIZE32) {
7468	yyerror("table name '%s' too long", yyvsp[-1].v.string);
7469	free(yyvsp[-1].v.string);
7470	YYERRORgoto yyerrlab;
7471	}
7472	yyval.v.host = calloc(1, sizeof(struct node_host));
7473	if (yyval.v.host == NULL((void *)0))
7474	err(1, "host: calloc");
7475	yyval.v.host->addr.type = PF_ADDR_TABLE;
7476	if (strlcpy(yyval.v.host->addr.v.tblname, yyvsp[-1].v.string,
7477	sizeof(yyval.v.host->addr.v.tblname)) >=
7478	sizeof(yyval.v.host->addr.v.tblname))
7479	errx(1, "host: strlcpy");
7480	free(yyvsp[-1].v.string);
7481	yyval.v.host->next = NULL((void *)0);
7482	yyval.v.host->tail = yyval.v.host;
7483	}
7484	break;
7485	case 265:
7486	#line 2737 "/usr/src/sbin/pfctl/parse.y"
7487	{
7488	yyval.v.host = calloc(1, sizeof(struct node_host));
7489	if (yyval.v.host == NULL((void *)0)) {
7490	free(yyvsp[0].v.string);
7491	err(1, "host: calloc");
7492	}
7493	yyval.v.host->addr.type = PF_ADDR_RTLABEL;
7494	if (strlcpy(yyval.v.host->addr.v.rtlabelname, yyvsp[0].v.string,
7495	sizeof(yyval.v.host->addr.v.rtlabelname)) >=
7496	sizeof(yyval.v.host->addr.v.rtlabelname)) {
7497	yyerror("route label too long, max %zu chars",
7498	sizeof(yyval.v.host->addr.v.rtlabelname) - 1);
7499	free(yyvsp[0].v.string);
7500	free(yyval.v.host);
7501	YYERRORgoto yyerrlab;
7502	}
7503	yyval.v.host->next = NULL((void *)0);
7504	yyval.v.host->tail = yyval.v.host;
7505	free(yyvsp[0].v.string);
7506	}
7507	break;
7508	case 267:
7509	#line 2760 "/usr/src/sbin/pfctl/parse.y"
7510	{
7511	u_long ulval;
7512
7513	if (atoul(yyvsp[0].v.string, &ulval) == -1) {
7514	yyerror("%s is not a number", yyvsp[0].v.string);
7515	free(yyvsp[0].v.string);
7516	YYERRORgoto yyerrlab;
7517	} else
7518	yyval.v.number = ulval;
7519	free(yyvsp[0].v.string);
7520	}
7521	break;
7522	case 268:
7523	#line 2773 "/usr/src/sbin/pfctl/parse.y"
7524	{
7525	int flags = 0;
7526	char p, op;
7527
7528	op = yyvsp[-1].v.string;
7529	if (!isalpha((unsigned char)op[0])) {
7530	yyerror("invalid interface name '%s'", op);
7531	free(op);
7532	YYERRORgoto yyerrlab;
7533	}
7534	while ((p = strrchr(yyvsp[-1].v.string, ':')) != NULL((void *)0)) {
7535	if (!strcmp(p+1, "network"))
7536	flags \|= PFI_AFLAG_NETWORK0x01;
7537	else if (!strcmp(p+1, "broadcast"))
7538	flags \|= PFI_AFLAG_BROADCAST0x02;
7539	else if (!strcmp(p+1, "peer"))
7540	flags \|= PFI_AFLAG_PEER0x04;
7541	else if (!strcmp(p+1, "0"))
7542	flags \|= PFI_AFLAG_NOALIAS0x08;
7543	else {
7544	yyerror("interface %s has bad modifier",
7545	yyvsp[-1].v.string);
7546	free(op);
7547	YYERRORgoto yyerrlab;
7548	}
7549	*p = '\0';
7550	}
7551	if (flags & (flags - 1) & PFI_AFLAG_MODEMASK0x07) {
7552	free(op);
7553	yyerror("illegal combination of "
7554	"interface modifiers");
7555	YYERRORgoto yyerrlab;
7556	}
7557	yyval.v.host = calloc(1, sizeof(struct node_host));
7558	if (yyval.v.host == NULL((void *)0))
7559	err(1, "address: calloc");
7560	yyval.v.host->af = 0;
7561	set_ipmask(yyval.v.host, 128);
7562	yyval.v.host->addr.type = PF_ADDR_DYNIFTL;
7563	yyval.v.host->addr.iflags = flags;
7564	if (strlcpy(yyval.v.host->addr.v.ifname, yyvsp[-1].v.string,
7565	sizeof(yyval.v.host->addr.v.ifname)) >=
7566	sizeof(yyval.v.host->addr.v.ifname)) {
7567	free(op);
7568	free(yyval.v.host);
7569	yyerror("interface name too long");
7570	YYERRORgoto yyerrlab;
7571	}
7572	free(op);
7573	yyval.v.host->next = NULL((void *)0);
7574	yyval.v.host->tail = yyval.v.host;
7575	}
7576	break;
7577	case 269:
7578	#line 2827 "/usr/src/sbin/pfctl/parse.y"
7579	{ yyval.v.port = yyvsp[0].v.port; }
7580	break;
7581	case 270:
7582	#line 2828 "/usr/src/sbin/pfctl/parse.y"
7583	{ yyval.v.port = yyvsp[-1].v.port; }
7584	break;
7585	case 271:
7586	#line 2831 "/usr/src/sbin/pfctl/parse.y"
7587	{ yyval.v.port = yyvsp[-1].v.port; }
7588	break;
7589	case 272:
7590	#line 2832 "/usr/src/sbin/pfctl/parse.y"
7591	{
7592	yyvsp[-3].v.port->tail->next = yyvsp[-1].v.port;
7593	yyvsp[-3].v.port->tail = yyvsp[-1].v.port;
7594	yyval.v.port = yyvsp[-3].v.port;
7595	}
7596	break;
7597	case 273:
7598	#line 2839 "/usr/src/sbin/pfctl/parse.y"
7599	{
7600	yyval.v.port = calloc(1, sizeof(struct node_port));
7601	if (yyval.v.port == NULL((void *)0))
7602	err(1, "port_item: calloc");
7603	yyval.v.port->port[0] = yyvsp[0].v.range.a;
7604	yyval.v.port->port[1] = yyvsp[0].v.range.b;
7605	if (yyvsp[0].v.range.t) {
7606	yyval.v.port->op = PF_OP_RRG;
7607
7608	if (validate_range(yyval.v.port->op, yyval.v.port->port[0],
7609	yyval.v.port->port[1])) {
7610	yyerror("invalid port range");
7611	YYERRORgoto yyerrlab;
7612	}
7613	} else
7614	yyval.v.port->op = PF_OP_EQ;
7615	yyval.v.port->next = NULL((void *)0);
7616	yyval.v.port->tail = yyval.v.port;
7617	}
7618	break;
7619	case 274:
7620	#line 2858 "/usr/src/sbin/pfctl/parse.y"
7621	{
7622	if (yyvsp[0].v.range.t) {
7623	yyerror("':' cannot be used with an other "
7624	"port operator");
7625	YYERRORgoto yyerrlab;
7626	}
7627	yyval.v.port = calloc(1, sizeof(struct node_port));
7628	if (yyval.v.port == NULL((void *)0))
7629	err(1, "port_item: calloc");
7630	yyval.v.port->port[0] = yyvsp[0].v.range.a;
7631	yyval.v.port->port[1] = yyvsp[0].v.range.b;
7632	yyval.v.port->op = yyvsp[-1].v.i;
7633	yyval.v.port->next = NULL((void *)0);
7634	yyval.v.port->tail = yyval.v.port;
7635	}
7636	break;
7637	case 275:
7638	#line 2873 "/usr/src/sbin/pfctl/parse.y"
7639	{
7640	if (yyvsp[-2].v.range.t \|\| yyvsp[0].v.range.t) {
7641	yyerror("':' cannot be used with an other "
7642	"port operator");
7643	YYERRORgoto yyerrlab;
7644	}
7645	yyval.v.port = calloc(1, sizeof(struct node_port));
7646	if (yyval.v.port == NULL((void *)0))
7647	err(1, "port_item: calloc");
7648	yyval.v.port->port[0] = yyvsp[-2].v.range.a;
7649	yyval.v.port->port[1] = yyvsp[0].v.range.a;
7650	yyval.v.port->op = yyvsp[-1].v.i;
7651	if (validate_range(yyval.v.port->op, yyval.v.port->port[0], yyval.v.port->port[1])) {
7652	yyerror("invalid port range");
7653	YYERRORgoto yyerrlab;
7654	}
7655	yyval.v.port->next = NULL((void *)0);
7656	yyval.v.port->tail = yyval.v.port;
7657	}
7658	break;
7659	case 276:
7660	#line 2894 "/usr/src/sbin/pfctl/parse.y"
7661	{
7662	if (parseport(yyvsp[0].v.string, &yyval.v.range, 0) == -1) {
7663	free(yyvsp[0].v.string);
7664	YYERRORgoto yyerrlab;
7665	}
7666	free(yyvsp[0].v.string);
7667	}
7668	break;
7669	case 277:
7670	#line 2903 "/usr/src/sbin/pfctl/parse.y"
7671	{
7672	if (parseport(yyvsp[0].v.string, &yyval.v.range, PPORT_RANGE1) == -1) {
7673	free(yyvsp[0].v.string);
7674	YYERRORgoto yyerrlab;
7675	}
7676	free(yyvsp[0].v.string);
7677	}
7678	break;
7679	case 278:
7680	#line 2912 "/usr/src/sbin/pfctl/parse.y"
7681	{ yyval.v.uid = yyvsp[0].v.uid; }
7682	break;
7683	case 279:
7684	#line 2913 "/usr/src/sbin/pfctl/parse.y"
7685	{ yyval.v.uid = yyvsp[-1].v.uid; }
7686	break;
7687	case 280:
7688	#line 2916 "/usr/src/sbin/pfctl/parse.y"
7689	{ yyval.v.uid = yyvsp[-1].v.uid; }
7690	break;
7691	case 281:
7692	#line 2917 "/usr/src/sbin/pfctl/parse.y"
7693	{
7694	yyvsp[-3].v.uid->tail->next = yyvsp[-1].v.uid;
7695	yyvsp[-3].v.uid->tail = yyvsp[-1].v.uid;
7696	yyval.v.uid = yyvsp[-3].v.uid;
7697	}
7698	break;
7699	case 282:
7700	#line 2924 "/usr/src/sbin/pfctl/parse.y"
7701	{
7702	yyval.v.uid = calloc(1, sizeof(struct node_uid));
7703	if (yyval.v.uid == NULL((void *)0))
7704	err(1, "uid_item: calloc");
7705	yyval.v.uid->uid[0] = yyvsp[0].v.number;
7706	yyval.v.uid->uid[1] = yyvsp[0].v.number;
7707	yyval.v.uid->op = PF_OP_EQ;
7708	yyval.v.uid->next = NULL((void *)0);
7709	yyval.v.uid->tail = yyval.v.uid;
7710	}
7711	break;
7712	case 283:
7713	#line 2934 "/usr/src/sbin/pfctl/parse.y"
7714	{
7715	if (yyvsp[0].v.number == -1 && yyvsp[-1].v.i != PF_OP_EQ && yyvsp[-1].v.i != PF_OP_NE) {
7716	yyerror("user unknown requires operator = or "
7717	"!=");
7718	YYERRORgoto yyerrlab;
7719	}
7720	yyval.v.uid = calloc(1, sizeof(struct node_uid));
7721	if (yyval.v.uid == NULL((void *)0))
7722	err(1, "uid_item: calloc");
7723	yyval.v.uid->uid[0] = yyvsp[0].v.number;
7724	yyval.v.uid->uid[1] = yyvsp[0].v.number;
7725	yyval.v.uid->op = yyvsp[-1].v.i;
7726	yyval.v.uid->next = NULL((void *)0);
7727	yyval.v.uid->tail = yyval.v.uid;
7728	}
7729	break;
7730	case 284:
7731	#line 2949 "/usr/src/sbin/pfctl/parse.y"
7732	{
7733	if (yyvsp[-2].v.number == -1 \|\| yyvsp[0].v.number == -1) {
7734	yyerror("user unknown requires operator = or "
7735	"!=");
7736	YYERRORgoto yyerrlab;
7737	}
7738	yyval.v.uid = calloc(1, sizeof(struct node_uid));
7739	if (yyval.v.uid == NULL((void *)0))
7740	err(1, "uid_item: calloc");
7741	yyval.v.uid->uid[0] = yyvsp[-2].v.number;
7742	yyval.v.uid->uid[1] = yyvsp[0].v.number;
7743	yyval.v.uid->op = yyvsp[-1].v.i;
7744	yyval.v.uid->next = NULL((void *)0);
7745	yyval.v.uid->tail = yyval.v.uid;
7746	}
7747	break;
7748	case 285:
7749	#line 2966 "/usr/src/sbin/pfctl/parse.y"
7750	{
7751	if (!strcmp(yyvsp[0].v.string, "unknown"))
7752	yyval.v.number = -1;
7753	else {
7754	uid_t uid;
7755
7756	if (uid_from_user(yyvsp[0].v.string, &uid) == -1) {
7757	yyerror("unknown user %s", yyvsp[0].v.string);
7758	free(yyvsp[0].v.string);
7759	YYERRORgoto yyerrlab;
7760	}
7761	yyval.v.number = uid;
7762	}
7763	free(yyvsp[0].v.string);
7764	}
7765	break;
7766	case 286:
7767	#line 2981 "/usr/src/sbin/pfctl/parse.y"
7768	{
7769	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number >= UID_MAX0xffffffffU) {
7770	yyerror("illegal uid value %lld", yyvsp[0].v.number);
7771	YYERRORgoto yyerrlab;
7772	}
7773	yyval.v.number = yyvsp[0].v.number;
7774	}
7775	break;
7776	case 287:
7777	#line 2990 "/usr/src/sbin/pfctl/parse.y"
7778	{ yyval.v.gid = yyvsp[0].v.gid; }
7779	break;
7780	case 288:
7781	#line 2991 "/usr/src/sbin/pfctl/parse.y"
7782	{ yyval.v.gid = yyvsp[-1].v.gid; }
7783	break;
7784	case 289:
7785	#line 2994 "/usr/src/sbin/pfctl/parse.y"
7786	{ yyval.v.gid = yyvsp[-1].v.gid; }
7787	break;
7788	case 290:
7789	#line 2995 "/usr/src/sbin/pfctl/parse.y"
7790	{
7791	yyvsp[-3].v.gid->tail->next = yyvsp[-1].v.gid;
7792	yyvsp[-3].v.gid->tail = yyvsp[-1].v.gid;
7793	yyval.v.gid = yyvsp[-3].v.gid;
7794	}
7795	break;
7796	case 291:
7797	#line 3002 "/usr/src/sbin/pfctl/parse.y"
7798	{
7799	yyval.v.gid = calloc(1, sizeof(struct node_gid));
7800	if (yyval.v.gid == NULL((void *)0))
7801	err(1, "gid_item: calloc");
7802	yyval.v.gid->gid[0] = yyvsp[0].v.number;
7803	yyval.v.gid->gid[1] = yyvsp[0].v.number;
7804	yyval.v.gid->op = PF_OP_EQ;
7805	yyval.v.gid->next = NULL((void *)0);
7806	yyval.v.gid->tail = yyval.v.gid;
7807	}
7808	break;
7809	case 292:
7810	#line 3012 "/usr/src/sbin/pfctl/parse.y"
7811	{
7812	if (yyvsp[0].v.number == -1 && yyvsp[-1].v.i != PF_OP_EQ && yyvsp[-1].v.i != PF_OP_NE) {
7813	yyerror("group unknown requires operator = or "
7814	"!=");
7815	YYERRORgoto yyerrlab;
7816	}
7817	yyval.v.gid = calloc(1, sizeof(struct node_gid));
7818	if (yyval.v.gid == NULL((void *)0))
7819	err(1, "gid_item: calloc");
7820	yyval.v.gid->gid[0] = yyvsp[0].v.number;
7821	yyval.v.gid->gid[1] = yyvsp[0].v.number;
7822	yyval.v.gid->op = yyvsp[-1].v.i;
7823	yyval.v.gid->next = NULL((void *)0);
7824	yyval.v.gid->tail = yyval.v.gid;
7825	}
7826	break;
7827	case 293:
7828	#line 3027 "/usr/src/sbin/pfctl/parse.y"
7829	{
7830	if (yyvsp[-2].v.number == -1 \|\| yyvsp[0].v.number == -1) {
7831	yyerror("group unknown requires operator = or "
7832	"!=");
7833	YYERRORgoto yyerrlab;
7834	}
7835	yyval.v.gid = calloc(1, sizeof(struct node_gid));
7836	if (yyval.v.gid == NULL((void *)0))
7837	err(1, "gid_item: calloc");
7838	yyval.v.gid->gid[0] = yyvsp[-2].v.number;
7839	yyval.v.gid->gid[1] = yyvsp[0].v.number;
7840	yyval.v.gid->op = yyvsp[-1].v.i;
7841	yyval.v.gid->next = NULL((void *)0);
7842	yyval.v.gid->tail = yyval.v.gid;
7843	}
7844	break;
7845	case 294:
7846	#line 3044 "/usr/src/sbin/pfctl/parse.y"
7847	{
7848	if (!strcmp(yyvsp[0].v.string, "unknown"))
7849	yyval.v.number = -1;
7850	else {
7851	gid_t gid;
7852
7853	if (gid_from_group(yyvsp[0].v.string, &gid) == -1) {
7854	yyerror("unknown group %s", yyvsp[0].v.string);
7855	free(yyvsp[0].v.string);
7856	YYERRORgoto yyerrlab;
7857	}
7858	yyval.v.number = gid;
7859	}
7860	free(yyvsp[0].v.string);
7861	}
7862	break;
7863	case 295:
7864	#line 3059 "/usr/src/sbin/pfctl/parse.y"
7865	{
7866	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number >= GID_MAX0xffffffffU) {
7867	yyerror("illegal gid value %lld", yyvsp[0].v.number);
7868	YYERRORgoto yyerrlab;
7869	}
7870	yyval.v.number = yyvsp[0].v.number;
7871	}
7872	break;
7873	case 296:
7874	#line 3068 "/usr/src/sbin/pfctl/parse.y"
7875	{
7876	int f;
7877
7878	if ((f = parse_flags(yyvsp[0].v.string)) < 0) {
7879	yyerror("bad flags %s", yyvsp[0].v.string);
7880	free(yyvsp[0].v.string);
7881	YYERRORgoto yyerrlab;
7882	}
7883	free(yyvsp[0].v.string);
7884	yyval.v.b.b1 = f;
7885	}
7886	break;
7887	case 297:
7888	#line 3081 "/usr/src/sbin/pfctl/parse.y"
7889	{ yyval.v.b.b1 = yyvsp[-2].v.b.b1; yyval.v.b.b2 = yyvsp[0].v.b.b1; }
7890	break;
7891	case 298:
7892	#line 3082 "/usr/src/sbin/pfctl/parse.y"
7893	{ yyval.v.b.b1 = 0; yyval.v.b.b2 = yyvsp[0].v.b.b1; }
7894	break;
7895	case 299:
7896	#line 3083 "/usr/src/sbin/pfctl/parse.y"
7897	{ yyval.v.b.b1 = 0; yyval.v.b.b2 = 0; }
7898	break;
7899	case 300:
7900	#line 3086 "/usr/src/sbin/pfctl/parse.y"
7901	{ yyval.v.icmp = yyvsp[0].v.icmp; }
7902	break;
7903	case 301:
7904	#line 3087 "/usr/src/sbin/pfctl/parse.y"
7905	{ yyval.v.icmp = yyvsp[-1].v.icmp; }
7906	break;
7907	case 302:
7908	#line 3088 "/usr/src/sbin/pfctl/parse.y"
7909	{ yyval.v.icmp = yyvsp[0].v.icmp; }
7910	break;
7911	case 303:
7912	#line 3089 "/usr/src/sbin/pfctl/parse.y"
7913	{ yyval.v.icmp = yyvsp[-1].v.icmp; }
7914	break;
7915	case 304:
7916	#line 3092 "/usr/src/sbin/pfctl/parse.y"
7917	{ yyval.v.icmp = yyvsp[-1].v.icmp; }
7918	break;
7919	case 305:
7920	#line 3093 "/usr/src/sbin/pfctl/parse.y"
7921	{
7922	yyvsp[-3].v.icmp->tail->next = yyvsp[-1].v.icmp;
7923	yyvsp[-3].v.icmp->tail = yyvsp[-1].v.icmp;
7924	yyval.v.icmp = yyvsp[-3].v.icmp;
7925	}
7926	break;
7927	case 306:
7928	#line 3100 "/usr/src/sbin/pfctl/parse.y"
7929	{ yyval.v.icmp = yyvsp[-1].v.icmp; }
7930	break;
7931	case 307:
7932	#line 3101 "/usr/src/sbin/pfctl/parse.y"
7933	{
7934	yyvsp[-3].v.icmp->tail->next = yyvsp[-1].v.icmp;
7935	yyvsp[-3].v.icmp->tail = yyvsp[-1].v.icmp;
7936	yyval.v.icmp = yyvsp[-3].v.icmp;
7937	}
7938	break;
7939	case 308:
7940	#line 3108 "/usr/src/sbin/pfctl/parse.y"
7941	{
7942	yyval.v.icmp = calloc(1, sizeof(struct node_icmp));
7943	if (yyval.v.icmp == NULL((void *)0))
7944	err(1, "icmp_item: calloc");
7945	yyval.v.icmp->type = yyvsp[0].v.number;
7946	yyval.v.icmp->code = 0;
7947	yyval.v.icmp->proto = IPPROTO_ICMP1;
7948	yyval.v.icmp->next = NULL((void *)0);
7949	yyval.v.icmp->tail = yyval.v.icmp;
7950	}
7951	break;
7952	case 309:
7953	#line 3118 "/usr/src/sbin/pfctl/parse.y"
7954	{
7955	const struct icmpcodeent *p;
7956
7957	if ((p = geticmpcodebyname(yyvsp[-2].v.number-1, yyvsp[0].v.string, AF_INET2)) == NULL((void *)0)) {
7958	yyerror("unknown icmp-code %s", yyvsp[0].v.string);
7959	free(yyvsp[0].v.string);
7960	YYERRORgoto yyerrlab;
7961	}
7962
7963	free(yyvsp[0].v.string);
7964	yyval.v.icmp = calloc(1, sizeof(struct node_icmp));
7965	if (yyval.v.icmp == NULL((void *)0))
7966	err(1, "icmp_item: calloc");
7967	yyval.v.icmp->type = yyvsp[-2].v.number;
7968	yyval.v.icmp->code = p->code + 1;
7969	yyval.v.icmp->proto = IPPROTO_ICMP1;
7970	yyval.v.icmp->next = NULL((void *)0);
7971	yyval.v.icmp->tail = yyval.v.icmp;
7972	}
7973	break;
7974	case 310:
7975	#line 3137 "/usr/src/sbin/pfctl/parse.y"
7976	{
7977	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > 255) {
7978	yyerror("illegal icmp-code %lld", yyvsp[0].v.number);
7979	YYERRORgoto yyerrlab;
7980	}
7981	yyval.v.icmp = calloc(1, sizeof(struct node_icmp));
7982	if (yyval.v.icmp == NULL((void *)0))
7983	err(1, "icmp_item: calloc");
7984	yyval.v.icmp->type = yyvsp[-2].v.number;
7985	yyval.v.icmp->code = yyvsp[0].v.number + 1;
7986	yyval.v.icmp->proto = IPPROTO_ICMP1;
7987	yyval.v.icmp->next = NULL((void *)0);
7988	yyval.v.icmp->tail = yyval.v.icmp;
7989	}
7990	break;
7991	case 311:
7992	#line 3153 "/usr/src/sbin/pfctl/parse.y"
7993	{
7994	yyval.v.icmp = calloc(1, sizeof(struct node_icmp));
7995	if (yyval.v.icmp == NULL((void *)0))
7996	err(1, "icmp_item: calloc");
7997	yyval.v.icmp->type = yyvsp[0].v.number;
7998	yyval.v.icmp->code = 0;
7999	yyval.v.icmp->proto = IPPROTO_ICMPV658;
8000	yyval.v.icmp->next = NULL((void *)0);
8001	yyval.v.icmp->tail = yyval.v.icmp;
8002	}
8003	break;
8004	case 312:
8005	#line 3163 "/usr/src/sbin/pfctl/parse.y"
8006	{
8007	const struct icmpcodeent *p;
8008
8009	if ((p = geticmpcodebyname(yyvsp[-2].v.number-1, yyvsp[0].v.string, AF_INET624)) == NULL((void *)0)) {
8010	yyerror("unknown icmp6-code %s", yyvsp[0].v.string);
8011	free(yyvsp[0].v.string);
8012	YYERRORgoto yyerrlab;
8013	}
8014	free(yyvsp[0].v.string);
8015
8016	yyval.v.icmp = calloc(1, sizeof(struct node_icmp));
8017	if (yyval.v.icmp == NULL((void *)0))
8018	err(1, "icmp_item: calloc");
8019	yyval.v.icmp->type = yyvsp[-2].v.number;
8020	yyval.v.icmp->code = p->code + 1;
8021	yyval.v.icmp->proto = IPPROTO_ICMPV658;
8022	yyval.v.icmp->next = NULL((void *)0);
8023	yyval.v.icmp->tail = yyval.v.icmp;
8024	}
8025	break;
8026	case 313:
8027	#line 3182 "/usr/src/sbin/pfctl/parse.y"
8028	{
8029	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > 255) {
8030	yyerror("illegal icmp-code %lld", yyvsp[0].v.number);
8031	YYERRORgoto yyerrlab;
8032	}
8033	yyval.v.icmp = calloc(1, sizeof(struct node_icmp));
8034	if (yyval.v.icmp == NULL((void *)0))
8035	err(1, "icmp_item: calloc");
8036	yyval.v.icmp->type = yyvsp[-2].v.number;
8037	yyval.v.icmp->code = yyvsp[0].v.number + 1;
8038	yyval.v.icmp->proto = IPPROTO_ICMPV658;
8039	yyval.v.icmp->next = NULL((void *)0);
8040	yyval.v.icmp->tail = yyval.v.icmp;
8041	}
8042	break;
8043	case 314:
8044	#line 3198 "/usr/src/sbin/pfctl/parse.y"
8045	{
8046	const struct icmptypeent *p;
8047
8048	if ((p = geticmptypebyname(yyvsp[0].v.string, AF_INET2)) == NULL((void *)0)) {
8049	yyerror("unknown icmp-type %s", yyvsp[0].v.string);
8050	free(yyvsp[0].v.string);
8051	YYERRORgoto yyerrlab;
8052	}
8053	yyval.v.number = p->type + 1;
8054	free(yyvsp[0].v.string);
8055	}
8056	break;
8057	case 315:
8058	#line 3209 "/usr/src/sbin/pfctl/parse.y"
8059	{
8060	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > 255) {
8061	yyerror("illegal icmp-type %lld", yyvsp[0].v.number);
8062	YYERRORgoto yyerrlab;
8063	}
8064	yyval.v.number = yyvsp[0].v.number + 1;
8065	}
8066	break;
8067	case 316:
8068	#line 3218 "/usr/src/sbin/pfctl/parse.y"
8069	{
8070	const struct icmptypeent *p;
8071
8072	if ((p = geticmptypebyname(yyvsp[0].v.string, AF_INET624)) ==
8073	NULL((void *)0)) {
8074	yyerror("unknown icmp6-type %s", yyvsp[0].v.string);
8075	free(yyvsp[0].v.string);
8076	YYERRORgoto yyerrlab;
8077	}
8078	yyval.v.number = p->type + 1;
8079	free(yyvsp[0].v.string);
8080	}
8081	break;
8082	case 317:
8083	#line 3230 "/usr/src/sbin/pfctl/parse.y"
8084	{
8085	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > 255) {
8086	yyerror("illegal icmp6-type %lld", yyvsp[0].v.number);
8087	YYERRORgoto yyerrlab;
8088	}
8089	yyval.v.number = yyvsp[0].v.number + 1;
8090	}
8091	break;
8092	case 318:
8093	#line 3239 "/usr/src/sbin/pfctl/parse.y"
8094	{
8095	int val;
8096	char *end;
8097
8098	if (map_tos(yyvsp[0].v.string, &val))
8099	yyval.v.number = val;
8100	else if (yyvsp[0].v.string[0] == '0' && yyvsp[0].v.string[1] == 'x') {
8101	errno(*__errno()) = 0;
8102	yyval.v.number = strtoul(yyvsp[0].v.string, &end, 16);
8103	if (errno(__errno()) \|\| end != '\0')
8104	yyval.v.number = 256;
8105	} else
8106	yyval.v.number = 256; /* flag bad argument */
8107	if (yyval.v.number < 0 \|\| yyval.v.number > 255) {
8108	yyerror("illegal tos value %s", yyvsp[0].v.string);
8109	free(yyvsp[0].v.string);
8110	YYERRORgoto yyerrlab;
8111	}
8112	free(yyvsp[0].v.string);
8113	}
8114	break;
8115	case 319:
8116	#line 3259 "/usr/src/sbin/pfctl/parse.y"
8117	{
8118	yyval.v.number = yyvsp[0].v.number;
8119	if (yyval.v.number < 0 \|\| yyval.v.number > 255) {
8120	yyerror("illegal tos value %lld", yyvsp[0].v.number);
8121	YYERRORgoto yyerrlab;
8122	}
8123	}
8124	break;
8125	case 320:
8126	#line 3268 "/usr/src/sbin/pfctl/parse.y"
8127	{ yyval.v.i = PF_SRCTRACK; }
8128	break;
8129	case 321:
8130	#line 3269 "/usr/src/sbin/pfctl/parse.y"
8131	{ yyval.v.i = PF_SRCTRACK_GLOBAL; }
8132	break;
8133	case 322:
8134	#line 3270 "/usr/src/sbin/pfctl/parse.y"
8135	{ yyval.v.i = PF_SRCTRACK_RULE; }
8136	break;
8137	case 323:
8138	#line 3273 "/usr/src/sbin/pfctl/parse.y"
8139	{
8140	yyval.v.i = PFRULE_IFBOUND0x00010000;
8141	}
8142	break;
8143	case 324:
8144	#line 3276 "/usr/src/sbin/pfctl/parse.y"
8145	{
8146	yyval.v.i = 0;
8147	}
8148	break;
8149	case 325:
8150	#line 3281 "/usr/src/sbin/pfctl/parse.y"
8151	{
8152	yyval.v.keep_state.action = 0;
8153	yyval.v.keep_state.options = NULL((void *)0);
8154	}
8155	break;
8156	case 326:
8157	#line 3285 "/usr/src/sbin/pfctl/parse.y"
8158	{
8159	yyval.v.keep_state.action = PF_STATE_NORMAL0x1;
8160	yyval.v.keep_state.options = yyvsp[0].v.state_opt;
8161	}
8162	break;
8163	case 327:
8164	#line 3289 "/usr/src/sbin/pfctl/parse.y"
8165	{
8166	yyval.v.keep_state.action = PF_STATE_MODULATE0x2;
8167	yyval.v.keep_state.options = yyvsp[0].v.state_opt;
8168	}
8169	break;
8170	case 328:
8171	#line 3293 "/usr/src/sbin/pfctl/parse.y"
8172	{
8173	yyval.v.keep_state.action = PF_STATE_SYNPROXY0x3;
8174	yyval.v.keep_state.options = yyvsp[0].v.state_opt;
8175	}
8176	break;
8177	case 329:
8178	#line 3299 "/usr/src/sbin/pfctl/parse.y"
8179	{ yyval.v.i = 0; }
8180	break;
8181	case 330:
8182	#line 3300 "/usr/src/sbin/pfctl/parse.y"
8183	{ yyval.v.i = PF_FLUSH0x01; }
8184	break;
8185	case 331:
8186	#line 3301 "/usr/src/sbin/pfctl/parse.y"
8187	{
8188	yyval.v.i = PF_FLUSH0x01 \| PF_FLUSH_GLOBAL0x02;
8189	}
8190	break;
8191	case 332:
8192	#line 3306 "/usr/src/sbin/pfctl/parse.y"
8193	{ yyval.v.state_opt = yyvsp[-1].v.state_opt; }
8194	break;
8195	case 333:
8196	#line 3307 "/usr/src/sbin/pfctl/parse.y"
8197	{ yyval.v.state_opt = NULL((void *)0); }
8198	break;
8199	case 334:
8200	#line 3310 "/usr/src/sbin/pfctl/parse.y"
8201	{ yyval.v.state_opt = yyvsp[0].v.state_opt; }
8202	break;
8203	case 335:
8204	#line 3311 "/usr/src/sbin/pfctl/parse.y"
8205	{
8206	yyvsp[-2].v.state_opt->tail->next = yyvsp[0].v.state_opt;
8207	yyvsp[-2].v.state_opt->tail = yyvsp[0].v.state_opt;
8208	yyval.v.state_opt = yyvsp[-2].v.state_opt;
8209	}
8210	break;
8211	case 336:
8212	#line 3318 "/usr/src/sbin/pfctl/parse.y"
8213	{
8214	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > UINT_MAX0xffffffffU) {
8215	yyerror("only positive values permitted");
8216	YYERRORgoto yyerrlab;
8217	}
8218	yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt));
8219	if (yyval.v.state_opt == NULL((void *)0))
8220	err(1, "state_opt_item: calloc");
8221	yyval.v.state_opt->type = PF_STATE_OPT_MAX;
8222	yyval.v.state_opt->data.max_states = yyvsp[0].v.number;
8223	yyval.v.state_opt->next = NULL((void *)0);
8224	yyval.v.state_opt->tail = yyval.v.state_opt;
8225	}
8226	break;
8227	case 337:
8228	#line 3331 "/usr/src/sbin/pfctl/parse.y"
8229	{
8230	yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt));
8231	if (yyval.v.state_opt == NULL((void *)0))
8232	err(1, "state_opt_item: calloc");
8233	yyval.v.state_opt->type = PF_STATE_OPT_NOSYNC;
8234	yyval.v.state_opt->next = NULL((void *)0);
8235	yyval.v.state_opt->tail = yyval.v.state_opt;
8236	}
8237	break;
8238	case 338:
8239	#line 3339 "/usr/src/sbin/pfctl/parse.y"
8240	{
8241	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > UINT_MAX0xffffffffU) {
8242	yyerror("only positive values permitted");
8243	YYERRORgoto yyerrlab;
8244	}
8245	yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt));
8246	if (yyval.v.state_opt == NULL((void *)0))
8247	err(1, "state_opt_item: calloc");
8248	yyval.v.state_opt->type = PF_STATE_OPT_MAX_SRC_STATES;
8249	yyval.v.state_opt->data.max_src_states = yyvsp[0].v.number;
8250	yyval.v.state_opt->next = NULL((void *)0);
8251	yyval.v.state_opt->tail = yyval.v.state_opt;
8252	}
8253	break;
8254	case 339:
8255	#line 3352 "/usr/src/sbin/pfctl/parse.y"
8256	{
8257	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > UINT_MAX0xffffffffU) {
8258	yyerror("only positive values permitted");
8259	YYERRORgoto yyerrlab;
8260	}
8261	yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt));
8262	if (yyval.v.state_opt == NULL((void *)0))
8263	err(1, "state_opt_item: calloc");
8264	yyval.v.state_opt->type = PF_STATE_OPT_MAX_SRC_CONN;
8265	yyval.v.state_opt->data.max_src_conn = yyvsp[0].v.number;
8266	yyval.v.state_opt->next = NULL((void *)0);
8267	yyval.v.state_opt->tail = yyval.v.state_opt;
8268	}
8269	break;
8270	case 340:
8271	#line 3365 "/usr/src/sbin/pfctl/parse.y"
8272	{
8273	if (yyvsp[-2].v.number < 0 \|\| yyvsp[-2].v.number > UINT_MAX0xffffffffU \|\|
8274	yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > UINT_MAX0xffffffffU) {
8275	yyerror("only positive values permitted");
8276	YYERRORgoto yyerrlab;
8277	}
8278	yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt));
8279	if (yyval.v.state_opt == NULL((void *)0))
8280	err(1, "state_opt_item: calloc");
8281	yyval.v.state_opt->type = PF_STATE_OPT_MAX_SRC_CONN_RATE;
8282	yyval.v.state_opt->data.max_src_conn_rate.limit = yyvsp[-2].v.number;
8283	yyval.v.state_opt->data.max_src_conn_rate.seconds = yyvsp[0].v.number;
8284	yyval.v.state_opt->next = NULL((void *)0);
8285	yyval.v.state_opt->tail = yyval.v.state_opt;
8286	}
8287	break;
8288	case 341:
8289	#line 3380 "/usr/src/sbin/pfctl/parse.y"
8290	{
8291	if (strlen(yyvsp[-2].v.string) >= PF_TABLE_NAME_SIZE32) {
8292	yyerror("table name '%s' too long", yyvsp[-2].v.string);
8293	free(yyvsp[-2].v.string);
8294	YYERRORgoto yyerrlab;
8295	}
8296	yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt));
8297	if (yyval.v.state_opt == NULL((void *)0))
8298	err(1, "state_opt_item: calloc");
8299	if (strlcpy(yyval.v.state_opt->data.overload.tblname, yyvsp[-2].v.string,
8300	PF_TABLE_NAME_SIZE32) >= PF_TABLE_NAME_SIZE32)
8301	errx(1, "state_opt_item: strlcpy");
8302	free(yyvsp[-2].v.string);
8303	yyval.v.state_opt->type = PF_STATE_OPT_OVERLOAD;
8304	yyval.v.state_opt->data.overload.flush = yyvsp[0].v.i;
8305	yyval.v.state_opt->next = NULL((void *)0);
8306	yyval.v.state_opt->tail = yyval.v.state_opt;
8307	}
8308	break;
8309	case 342:
8310	#line 3398 "/usr/src/sbin/pfctl/parse.y"
8311	{
8312	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > UINT_MAX0xffffffffU) {
8313	yyerror("only positive values permitted");
8314	YYERRORgoto yyerrlab;
8315	}
8316	yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt));
8317	if (yyval.v.state_opt == NULL((void *)0))
8318	err(1, "state_opt_item: calloc");
8319	yyval.v.state_opt->type = PF_STATE_OPT_MAX_SRC_NODES;
8320	yyval.v.state_opt->data.max_src_nodes = yyvsp[0].v.number;
8321	yyval.v.state_opt->next = NULL((void *)0);
8322	yyval.v.state_opt->tail = yyval.v.state_opt;
8323	}
8324	break;
8325	case 343:
8326	#line 3411 "/usr/src/sbin/pfctl/parse.y"
8327	{
8328	yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt));
8329	if (yyval.v.state_opt == NULL((void *)0))
8330	err(1, "state_opt_item: calloc");
8331	yyval.v.state_opt->type = PF_STATE_OPT_SRCTRACK;
8332	yyval.v.state_opt->data.src_track = yyvsp[0].v.i;
8333	yyval.v.state_opt->next = NULL((void *)0);
8334	yyval.v.state_opt->tail = yyval.v.state_opt;
8335	}
8336	break;
8337	case 344:
8338	#line 3420 "/usr/src/sbin/pfctl/parse.y"
8339	{
8340	yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt));
8341	if (yyval.v.state_opt == NULL((void *)0))
8342	err(1, "state_opt_item: calloc");
8343	yyval.v.state_opt->type = PF_STATE_OPT_STATELOCK;
8344	yyval.v.state_opt->data.statelock = yyvsp[0].v.i;
8345	yyval.v.state_opt->next = NULL((void *)0);
8346	yyval.v.state_opt->tail = yyval.v.state_opt;
8347	}
8348	break;
8349	case 345:
8350	#line 3429 "/usr/src/sbin/pfctl/parse.y"
8351	{
8352	yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt));
8353	if (yyval.v.state_opt == NULL((void *)0))
8354	err(1, "state_opt_item: calloc");
8355	yyval.v.state_opt->type = PF_STATE_OPT_SLOPPY;
8356	yyval.v.state_opt->next = NULL((void *)0);
8357	yyval.v.state_opt->tail = yyval.v.state_opt;
8358	}
8359	break;
8360	case 346:
8361	#line 3437 "/usr/src/sbin/pfctl/parse.y"
8362	{
8363	yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt));
8364	if (yyval.v.state_opt == NULL((void *)0))
8365	err(1, "state_opt_item: calloc");
8366	yyval.v.state_opt->type = PF_STATE_OPT_PFLOW;
8367	yyval.v.state_opt->next = NULL((void *)0);
8368	yyval.v.state_opt->tail = yyval.v.state_opt;
8369	}
8370	break;
8371	case 347:
8372	#line 3445 "/usr/src/sbin/pfctl/parse.y"
8373	{
8374	int i;
8375
8376	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > UINT_MAX0xffffffffU) {
8377	yyerror("only positive values permitted");
8378	YYERRORgoto yyerrlab;
8379	}
8380	for (i = 0; pf_timeouts[i].name &&
8381	strcmp(pf_timeouts[i].name, yyvsp[-1].v.string); ++i)
8382	; /* nothing */
8383	if (!pf_timeouts[i].name) {
8384	yyerror("illegal timeout name %s", yyvsp[-1].v.string);
8385	free(yyvsp[-1].v.string);
8386	YYERRORgoto yyerrlab;
8387	}
8388	if (strchr(pf_timeouts[i].name, '.') == NULL((void *)0)) {
8389	yyerror("illegal state timeout %s", yyvsp[-1].v.string);
8390	free(yyvsp[-1].v.string);
8391	YYERRORgoto yyerrlab;
8392	}
8393	free(yyvsp[-1].v.string);
8394	yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt));
8395	if (yyval.v.state_opt == NULL((void *)0))
8396	err(1, "state_opt_item: calloc");
8397	yyval.v.state_opt->type = PF_STATE_OPT_TIMEOUT;
8398	yyval.v.state_opt->data.timeout.number = pf_timeouts[i].timeout;
8399	yyval.v.state_opt->data.timeout.seconds = yyvsp[0].v.number;
8400	yyval.v.state_opt->next = NULL((void *)0);
8401	yyval.v.state_opt->tail = yyval.v.state_opt;
8402	}
8403	break;
8404	case 348:
8405	#line 3477 "/usr/src/sbin/pfctl/parse.y"
8406	{
8407	yyval.v.string = yyvsp[0].v.string;
8408	}
8409	break;
8410	case 349:
8411	#line 3482 "/usr/src/sbin/pfctl/parse.y"
8412	{
8413	struct pfctl_qsitem *qsi;
8414
8415	if ((qsi = pfctl_find_queue(yyvsp[0].v.string, &qspecs)) == NULL((void *)0)) {
8416	yyerror("queue %s is not defined", yyvsp[0].v.string);
8417	YYERRORgoto yyerrlab;
8418	}
8419	yyval.v.qassign.qname = yyvsp[0].v.string;
8420	yyval.v.qassign.pqname = NULL((void *)0);
8421	}
8422	break;
8423	case 350:
8424	#line 3492 "/usr/src/sbin/pfctl/parse.y"
8425	{
8426	struct pfctl_qsitem *qsi;
8427
8428	if ((qsi = pfctl_find_queue(yyvsp[-1].v.string, &qspecs)) == NULL((void *)0)) {
	Although the value stored to 'qsi' is used in the enclosing expression, the value is never actually read from 'qsi'
8429	yyerror("queue %s is not defined", yyvsp[-1].v.string);
8430	YYERRORgoto yyerrlab;
8431	}
8432	yyval.v.qassign.qname = yyvsp[-1].v.string;
8433	yyval.v.qassign.pqname = NULL((void *)0);
8434	}
8435	break;
8436	case 351:
8437	#line 3502 "/usr/src/sbin/pfctl/parse.y"
8438	{
8439	struct pfctl_qsitem qsi, pqsi;
8440
8441	if ((qsi = pfctl_find_queue(yyvsp[-3].v.string, &qspecs)) == NULL((void *)0)) {
8442	yyerror("queue %s is not defined", yyvsp[-3].v.string);
8443	YYERRORgoto yyerrlab;
8444	}
8445	if ((pqsi = pfctl_find_queue(yyvsp[-1].v.string, &qspecs)) == NULL((void *)0)) {
8446	yyerror("queue %s is not defined", yyvsp[-1].v.string);
8447	YYERRORgoto yyerrlab;
8448	}
8449	yyval.v.qassign.qname = yyvsp[-3].v.string;
8450	yyval.v.qassign.pqname = yyvsp[-1].v.string;
8451	}
8452	break;
8453	case 352:
8454	#line 3518 "/usr/src/sbin/pfctl/parse.y"
8455	{
8456	if (parseport(yyvsp[0].v.string, &yyval.v.range, PPORT_RANGE1\|PPORT_STAR2) == -1) {
8457	free(yyvsp[0].v.string);
8458	YYERRORgoto yyerrlab;
8459	}
8460	free(yyvsp[0].v.string);
8461	}
8462	break;
8463	case 353:
8464	#line 3527 "/usr/src/sbin/pfctl/parse.y"
8465	{
8466	if (yyvsp[0].v.weight > 0) {
8467	struct node_host *n;
8468	for (n = yyvsp[-1].v.host; n != NULL((void *)0); n = n->next)
8469	n->weight = yyvsp[0].v.weight;
8470	}
8471	yyval.v.host = yyvsp[-1].v.host;
8472	}
8473	break;
8474	case 354:
8475	#line 3535 "/usr/src/sbin/pfctl/parse.y"
8476	{ yyval.v.host = yyvsp[-1].v.host; }
8477	break;
8478	case 355:
8479	#line 3538 "/usr/src/sbin/pfctl/parse.y"
8480	{
8481	if (yyvsp[-2].v.host->addr.type != PF_ADDR_ADDRMASK) {
8482	free(yyvsp[-2].v.host);
8483	yyerror("only addresses can be listed for "
8484	"redirection pools ");
8485	YYERRORgoto yyerrlab;
8486	}
8487	if (yyvsp[-1].v.weight > 0) {
8488	struct node_host *n;
8489	for (n = yyvsp[-2].v.host; n != NULL((void *)0); n = n->next)
8490	n->weight = yyvsp[-1].v.weight;
8491	}
8492	yyval.v.host = yyvsp[-2].v.host;
8493	}
8494	break;
8495	case 356:
8496	#line 3552 "/usr/src/sbin/pfctl/parse.y"
8497	{
8498	yyvsp[-4].v.host->tail->next = yyvsp[-2].v.host;
8499	yyvsp[-4].v.host->tail = yyvsp[-2].v.host->tail;
8500	if (yyvsp[-1].v.weight > 0) {
8501	struct node_host *n;
8502	for (n = yyvsp[-2].v.host; n != NULL((void *)0); n = n->next)
8503	n->weight = yyvsp[-1].v.weight;
8504	}
8505	yyval.v.host = yyvsp[-4].v.host;
8506	}
8507	break;
8508	case 357:
8509	#line 3564 "/usr/src/sbin/pfctl/parse.y"
8510	{
8511	yyval.v.redirection = calloc(1, sizeof(struct redirection));
8512	if (yyval.v.redirection == NULL((void *)0))
8513	err(1, "redirection: calloc");
8514	yyval.v.redirection->host = yyvsp[0].v.host;
8515	yyval.v.redirection->rport.a = yyval.v.redirection->rport.b = yyval.v.redirection->rport.t = 0;
8516	}
8517	break;
8518	case 358:
8519	#line 3571 "/usr/src/sbin/pfctl/parse.y"
8520	{
8521	yyval.v.redirection = calloc(1, sizeof(struct redirection));
8522	if (yyval.v.redirection == NULL((void *)0))
8523	err(1, "redirection: calloc");
8524	yyval.v.redirection->host = yyvsp[-2].v.host;
8525	yyval.v.redirection->rport = yyvsp[0].v.range;
8526	}
8527	break;
8528	case 359:
8529	#line 3581 "/usr/src/sbin/pfctl/parse.y"
8530	{
8531	yyval.v.hashkey = calloc(1, sizeof(struct pf_poolhashkey));
8532	if (yyval.v.hashkey == NULL((void *)0))
8533	err(1, "hashkey: calloc");
8534	yyval.v.hashkey->key32pfk.key32[0] = arc4random();
8535	yyval.v.hashkey->key32pfk.key32[1] = arc4random();
8536	yyval.v.hashkey->key32pfk.key32[2] = arc4random();
8537	yyval.v.hashkey->key32pfk.key32[3] = arc4random();
8538	}
8539	break;
8540	case 360:
8541	#line 3591 "/usr/src/sbin/pfctl/parse.y"
8542	{
8543	if (!strncmp(yyvsp[0].v.string, "0x", 2)) {
8544	if (strlen(yyvsp[0].v.string) != 34) {
8545	free(yyvsp[0].v.string);
8546	yyerror("hex key must be 128 bits "
8547	"(32 hex digits) long");
8548	YYERRORgoto yyerrlab;
8549	}
8550	yyval.v.hashkey = calloc(1, sizeof(struct pf_poolhashkey));
8551	if (yyval.v.hashkey == NULL((void *)0))
8552	err(1, "hashkey: calloc");
8553
8554	if (sscanf(yyvsp[0].v.string, "0x%8x%8x%8x%8x",
8555	&yyval.v.hashkey->key32pfk.key32[0], &yyval.v.hashkey->key32pfk.key32[1],
8556	&yyval.v.hashkey->key32pfk.key32[2], &yyval.v.hashkey->key32pfk.key32[3]) != 4) {
8557	free(yyval.v.hashkey);
8558	free(yyvsp[0].v.string);
8559	yyerror("invalid hex key");
8560	YYERRORgoto yyerrlab;
8561	}
8562	} else {
8563	MD5_CTX context;
8564
8565	yyval.v.hashkey = calloc(1, sizeof(struct pf_poolhashkey));
8566	if (yyval.v.hashkey == NULL((void *)0))
8567	err(1, "hashkey: calloc");
8568	MD5Init(&context);
8569	MD5Update(&context, (unsigned char *)yyvsp[0].v.string,
8570	strlen(yyvsp[0].v.string));
8571	MD5Final((unsigned char *)yyval.v.hashkey, &context);
8572	HTONL(yyval.v.hashkey->key32[0])(yyval.v.hashkey->pfk.key32[0]) = (__uint32_t)(__builtin_constant_p ((u_int32_t)(yyval.v.hashkey->pfk.key32[0])) ? (__uint32_t )(((__uint32_t)((u_int32_t)(yyval.v.hashkey->pfk.key32[0]) ) & 0xff) << 24 \| ((__uint32_t)((u_int32_t)(yyval.v .hashkey->pfk.key32[0])) & 0xff00) << 8 \| ((__uint32_t )((u_int32_t)(yyval.v.hashkey->pfk.key32[0])) & 0xff0000 ) >> 8 \| ((__uint32_t)((u_int32_t)(yyval.v.hashkey-> pfk.key32[0])) & 0xff000000) >> 24) : __swap32md((u_int32_t )(yyval.v.hashkey->pfk.key32[0])));
8573	HTONL(yyval.v.hashkey->key32[1])(yyval.v.hashkey->pfk.key32[1]) = (__uint32_t)(__builtin_constant_p ((u_int32_t)(yyval.v.hashkey->pfk.key32[1])) ? (__uint32_t )(((__uint32_t)((u_int32_t)(yyval.v.hashkey->pfk.key32[1]) ) & 0xff) << 24 \| ((__uint32_t)((u_int32_t)(yyval.v .hashkey->pfk.key32[1])) & 0xff00) << 8 \| ((__uint32_t )((u_int32_t)(yyval.v.hashkey->pfk.key32[1])) & 0xff0000 ) >> 8 \| ((__uint32_t)((u_int32_t)(yyval.v.hashkey-> pfk.key32[1])) & 0xff000000) >> 24) : __swap32md((u_int32_t )(yyval.v.hashkey->pfk.key32[1])));
8574	HTONL(yyval.v.hashkey->key32[2])(yyval.v.hashkey->pfk.key32[2]) = (__uint32_t)(__builtin_constant_p ((u_int32_t)(yyval.v.hashkey->pfk.key32[2])) ? (__uint32_t )(((__uint32_t)((u_int32_t)(yyval.v.hashkey->pfk.key32[2]) ) & 0xff) << 24 \| ((__uint32_t)((u_int32_t)(yyval.v .hashkey->pfk.key32[2])) & 0xff00) << 8 \| ((__uint32_t )((u_int32_t)(yyval.v.hashkey->pfk.key32[2])) & 0xff0000 ) >> 8 \| ((__uint32_t)((u_int32_t)(yyval.v.hashkey-> pfk.key32[2])) & 0xff000000) >> 24) : __swap32md((u_int32_t )(yyval.v.hashkey->pfk.key32[2])));
8575	HTONL(yyval.v.hashkey->key32[3])(yyval.v.hashkey->pfk.key32[3]) = (__uint32_t)(__builtin_constant_p ((u_int32_t)(yyval.v.hashkey->pfk.key32[3])) ? (__uint32_t )(((__uint32_t)((u_int32_t)(yyval.v.hashkey->pfk.key32[3]) ) & 0xff) << 24 \| ((__uint32_t)((u_int32_t)(yyval.v .hashkey->pfk.key32[3])) & 0xff00) << 8 \| ((__uint32_t )((u_int32_t)(yyval.v.hashkey->pfk.key32[3])) & 0xff0000 ) >> 8 \| ((__uint32_t)((u_int32_t)(yyval.v.hashkey-> pfk.key32[3])) & 0xff000000) >> 24) : __swap32md((u_int32_t )(yyval.v.hashkey->pfk.key32[3])));
8576	}
8577	free(yyvsp[0].v.string);
8578	}
8579	break;
8580	case 361:
8581	#line 3630 "/usr/src/sbin/pfctl/parse.y"
8582	{ bzero(&pool_opts, sizeof pool_opts); }
8583	break;
8584	case 362:
8585	#line 3632 "/usr/src/sbin/pfctl/parse.y"
8586	{ yyval.v.pool_opts = pool_opts; }
8587	break;
8588	case 363:
8589	#line 3633 "/usr/src/sbin/pfctl/parse.y"
8590	{
8591	bzero(&pool_opts, sizeof pool_opts);
8592	yyval.v.pool_opts = pool_opts;
8593	}
8594	break;
8595	case 366:
8596	#line 3643 "/usr/src/sbin/pfctl/parse.y"
8597	{
8598	if (pool_opts.type) {
8599	yyerror("pool type cannot be redefined");
8600	YYERRORgoto yyerrlab;
8601	}
8602	pool_opts.type = PF_POOL_BITMASK;
8603	}
8604	break;
8605	case 367:
8606	#line 3650 "/usr/src/sbin/pfctl/parse.y"
8607	{
8608	if (pool_opts.type) {
8609	yyerror("pool type cannot be redefined");
8610	YYERRORgoto yyerrlab;
8611	}
8612	pool_opts.type = PF_POOL_RANDOM;
8613	}
8614	break;
8615	case 368:
8616	#line 3657 "/usr/src/sbin/pfctl/parse.y"
8617	{
8618	if (pool_opts.type) {
8619	yyerror("pool type cannot be redefined");
8620	YYERRORgoto yyerrlab;
8621	}
8622	pool_opts.type = PF_POOL_SRCHASH;
8623	pool_opts.key = yyvsp[0].v.hashkey;
8624	}
8625	break;
8626	case 369:
8627	#line 3665 "/usr/src/sbin/pfctl/parse.y"
8628	{
8629	if (pool_opts.type) {
8630	yyerror("pool type cannot be redefined");
8631	YYERRORgoto yyerrlab;
8632	}
8633	pool_opts.type = PF_POOL_ROUNDROBIN;
8634	}
8635	break;
8636	case 370:
8637	#line 3672 "/usr/src/sbin/pfctl/parse.y"
8638	{
8639	if (pool_opts.type) {
8640	yyerror("pool type cannot be redefined");
8641	YYERRORgoto yyerrlab;
8642	}
8643	pool_opts.type = PF_POOL_LEASTSTATES;
8644	}
8645	break;
8646	case 371:
8647	#line 3679 "/usr/src/sbin/pfctl/parse.y"
8648	{
8649	if (pool_opts.staticport) {
8650	yyerror("static-port cannot be redefined");
8651	YYERRORgoto yyerrlab;
8652	}
8653	pool_opts.staticport = 1;
8654	}
8655	break;
8656	case 372:
8657	#line 3686 "/usr/src/sbin/pfctl/parse.y"
8658	{
8659	if (pool_opts.marker & POM_STICKYADDRESS0x02) {
8660	yyerror("sticky-address cannot be redefined");
8661	YYERRORgoto yyerrlab;
8662	}
8663	pool_opts.marker \|= POM_STICKYADDRESS0x02;
8664	pool_opts.opts \|= PF_POOL_STICKYADDR0x20;
8665	}
8666	break;
8667	case 373:
8668	#line 3696 "/usr/src/sbin/pfctl/parse.y"
8669	{
8670	struct redirection *redir;
8671	if (filter_opts.rt != PF_NOPFROUTE) {
8672	yyerror("cannot respecify "
8673	"route-to/reply-to/dup-to");
8674	YYERRORgoto yyerrlab;
8675	}
8676	redir = calloc(1, sizeof(*redir));
8677	if (redir == NULL((void *)0))
8678	err(1, "routespec calloc");
8679	redir->host = yyvsp[-1].v.host;
8680	filter_opts.rroute.rdr = redir;
8681	memcpy(&filter_opts.rroute.pool_opts, &yyvsp[0].v.pool_opts,
8682	sizeof(filter_opts.rroute.pool_opts));
8683	}
8684	break;
8685	case 374:
8686	#line 3714 "/usr/src/sbin/pfctl/parse.y"
8687	{
8688	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > UINT_MAX0xffffffffU) {
8689	yyerror("only positive values permitted");
8690	YYERRORgoto yyerrlab;
8691	}
8692	if (pfctl_set_timeout(pf, yyvsp[-1].v.string, yyvsp[0].v.number, 0) != 0) {
8693	yyerror("unknown timeout %s", yyvsp[-1].v.string);
8694	free(yyvsp[-1].v.string);
8695	YYERRORgoto yyerrlab;
8696	}
8697	free(yyvsp[-1].v.string);
8698	}
8699	break;
8700	case 377:
8701	#line 3733 "/usr/src/sbin/pfctl/parse.y"
8702	{
8703	if (yyvsp[0].v.number < 0 \|\| yyvsp[0].v.number > UINT_MAX0xffffffffU) {
8704	yyerror("only positive values permitted");
8705	YYERRORgoto yyerrlab;
8706	}
8707	if (pfctl_set_limit(pf, yyvsp[-1].v.string, yyvsp[0].v.number) != 0) {
8708	yyerror("unable to set limit %s %lld", yyvsp[-1].v.string, yyvsp[0].v.number);
8709	free(yyvsp[-1].v.string);
8710	YYERRORgoto yyerrlab;
8711	}
8712	free(yyvsp[-1].v.string);
8713	}
8714	break;
8715	case 382:
8716	#line 3755 "/usr/src/sbin/pfctl/parse.y"
8717	{ yyval.v.number = 0; }
8718	break;
8719	case 383:
8720	#line 3756 "/usr/src/sbin/pfctl/parse.y"
8721	{
8722	if (!strcmp(yyvsp[0].v.string, "yes"))
8723	yyval.v.number = 1;
8724	else {
8725	yyerror("invalid value '%s', expected 'yes' "
8726	"or 'no'", yyvsp[0].v.string);
8727	free(yyvsp[0].v.string);
8728	YYERRORgoto yyerrlab;
8729	}
8730	free(yyvsp[0].v.string);
8731	}
8732	break;
8733	case 384:
8734	#line 3769 "/usr/src/sbin/pfctl/parse.y"
8735	{ yyval.v.i = PF_OP_EQ; }
8736	break;
8737	case 385:
8738	#line 3770 "/usr/src/sbin/pfctl/parse.y"
8739	{ yyval.v.i = PF_OP_NE; }
8740	break;
8741	case 386:
8742	#line 3771 "/usr/src/sbin/pfctl/parse.y"
8743	{ yyval.v.i = PF_OP_LE; }
8744	break;
8745	case 387:
8746	#line 3772 "/usr/src/sbin/pfctl/parse.y"
8747	{ yyval.v.i = PF_OP_LT; }
8748	break;
8749	case 388:
8750	#line 3773 "/usr/src/sbin/pfctl/parse.y"
8751	{ yyval.v.i = PF_OP_GE; }
8752	break;
8753	case 389:
8754	#line 3774 "/usr/src/sbin/pfctl/parse.y"
8755	{ yyval.v.i = PF_OP_GT; }
8756	break;
8757	#line 8750 "parse.c"
8758	}
8759	yyssp -= yym;
8760	yystate = *yyssp;
8761	yyvsp -= yym;
8762	yym = yylhs[yyn];
8763	if (yystate == 0 && yym == 0)
8764	{
8765	#if YYDEBUG0
8766	if (yydebug)
8767	printf("%sdebug: after reduction, shifting from state 0 to\
8768	state %d\n", YYPREFIX"yy", YYFINAL2);
8769	#endif
8770	yystate = YYFINAL2;
8771	*++yyssp = YYFINAL2;
8772	*++yyvsp = yyval;
8773	if (yychar < 0)
8774	{
8775	if ((yychar = yylex()) < 0) yychar = 0;
8776	#if YYDEBUG0
8777	if (yydebug)
8778	{
8779	yys = 0;
8780	if (yychar <= YYMAXTOKEN385) yys = yyname[yychar];
8781	if (!yys) yys = "illegal-symbol";
8782	printf("%sdebug: state %d, reading %d (%s)\n",
8783	YYPREFIX"yy", YYFINAL2, yychar, yys);
8784	}
8785	#endif
8786	}
8787	if (yychar == 0) goto yyaccept;
8788	goto yyloop;
8789	}
8790	if ((yyn = yygindex[yym]) && (yyn += yystate) >= 0 &&
8791	yyn <= YYTABLESIZE5732 && yycheck[yyn] == yystate)
8792	yystate = yytable[yyn];
8793	else
8794	yystate = yydgoto[yym];
8795	#if YYDEBUG0
8796	if (yydebug)
8797	printf("%sdebug: after reduction, shifting from state %d \
8798	to state %d\n", YYPREFIX"yy", *yyssp, yystate);
8799	#endif
8800	if (yyssp >= yysslim && yygrowstack())
8801	{
8802	goto yyoverflow;
8803	}
8804	*++yyssp = yystate;
8805	*++yyvsp = yyval;
8806	goto yyloop;
8807	yyoverflow:
8808	yyerror("yacc stack overflow");
8809	yyabort:
8810	if (yyss)
8811	free(yyss);
8812	if (yyvs)
8813	free(yyvs);
8814	yyss = yyssp = NULL((void *)0);
8815	yyvs = yyvsp = NULL((void *)0);
8816	yystacksize = 0;
8817	return (1);
8818	yyaccept:
8819	if (yyss)
8820	free(yyss);
8821	if (yyvs)
8822	free(yyvs);
8823	yyss = yyssp = NULL((void *)0);
8824	yyvs = yyvsp = NULL((void *)0);
8825	yystacksize = 0;
8826	return (0);
8827	}